Topics of Interest: vAPI: Vulnerable Adversely Programmed Interface (API Top 10)
summary
A runnable vAPI lab reproduces the OWASP API Top 10 2019 as ten sequential exercises that yield a flag when exploited. The environment is vAPI lab with 10 exercises, currently Dockerized with Postman collection and also runnable on a PHP/MySQL stack migrating to Laravel. Demos show broken object level authorization (IDOR) by iterating numeric IDs, and tools like Postman, Burp/mitm and docker‑compose actually launch the service so attacks and fixes can be tested end to end.
AI-written summary · about
chapters (10)
- 0:00vAPI introduction
- 1:51What is vAPI and install
- 4:46Installation methods
- 8:45OAS API Top 10 overview
- 9:28API vs web app vulns
- 13:07API security trends
- 13:50vAPI roadmap
- 14:57Broken object auth demo
- 20:30Challenge docs and resources
- 21:33Acknowledgments
