APIs Under
Attack
Hack a deliberately broken API, learn the OWASP API Top 10, then watch the platform catch every move in real time.
House Rules
Chatham House Rule
What's shared here, stays here. Borrow the lessons — not the names.
No such thing as a silly question
The only dumb question is the one you catch (e) { /* ignore */ }. Ask it out loud.
Only hack what we hand you
The crAPI box is fair game. The conference Wi-Fi, your neighbour, and prod are strictly 403 Forbidden.
Break it, then break it again
id=1337, weird payloads, evil edge cases — reckless curiosity is the entire point today.
Stuck? raise Hand()
Rubber-duck your neighbour first, then wave me over. No suffering in silence.
APIs are the internet's plumbing
Every app you touched today — banking, ride-hailing, streaming, checkout — is really a swarm of API calls behind a screen. A single tap can fan out into dozens of them.
This isn't theoretical.
Three real API failures from the last 18 months — each maps straight onto the OWASP API Top 10.
McDonald's “McHire”
Admin login of 123456 / 123456 plus an IDOR on the applicant API — increment an ID, read anyone's record. Up to ~64M applicants exposed.
API1 BOLA + API2 Broken Auth ▸ Click for the storyServiceNow
An API endpoint left with authentication turned off let unauthenticated requests query customer instance tables.
API2 Broken Auth + API8 Misconfig ▸ Click for the storyDeepSeek
A public, unauthenticated database exposed 1M+ log lines — plaintext chat history and live API keys.
API8 Misconfig + API2 Broken Auth ▸ Click for the storyThe OWASP API
Security Top 10
OWASP is a nonprofit that catalogs the most critical security risks on the web. The API Security Top 10 is the field guide to exactly how APIs get broken — and it's what crAPI was built to teach.
Ten ways to break an API
Broken Object Level Authorization
The server returns the object you asked for — but never checks that you own it. Change the ID, get someone else's data. It's the flaw crAPI teaches first.
GET /identity/api/v2/user/dashboard?id=1337
⚠ You are not user 1337 — but the API answered anyway.
The lesson: authentication proves who you are. Authorization proves what you're allowed to touch. BOLA is forgetting the second one.
Meet crAPI
The completely ridiculous API — an intentionally broken app (a car-service platform) built by OWASP to teach the API Top 10. For the next hour, breaking it is your job.
A real-ish app
Signup, login, vehicles, shop, community — it behaves like a genuine product.
Deliberately broken
BOLA, broken auth, mass assignment, SSRF — the Top 10, waiting to be found.
Safe to hack
It's a disposable instance deployed just for this room. Go wild.
Sign up. Grab your keys. Let's go.
Four steps on the left, three URLs on the right. Register on crAPI, pull the vehicle codes from MailHog, then meet us back for the first challenge — ~10 minutes.
Sign up on crAPI
Click Signup, invent a fake identity — not a real email.
Log in → + Add a Vehicle
crAPI emails you a VIN and a PIN.
Open MailHog, grab the codes
Heads up: VIN and PIN print in the opposite order.
Paste VIN + PIN → OK
You're now a fully broken user with a car. Perfect.
.nnsworkshop.com
.nnsworkshop.com
.nnsworkshop.com/guide
Help us make the next one better.
Your feedback helps shape future API security workshops. Share what worked and what we can improve.
Thank you for joining us.