Lab: Exploiting an API endpoint using documentation
After starting the exercise, the shop should look similar to the following image. Click on the My account link to open the registration form. Here we enter our access data, user name: wiener, password: peter.
The registration form is shown in the next picture.
In our account we see our user name and email address. We also have access to the function for changing our email address.
We will now change our email address to hacker1@hackerone.org.
We now switch to the Burp Suite and open the Burp Proxy and the HTTP history tab.
We now search for the request PATCH /api/user/wiener in the HTTP history and send it to the Burp Repeater.
To send to the Burp Repeater, move the mouse over the request and press the right mouse button. A context menu appears in which we select the Send to Repeater option.
We now switch to the Burp Repeater and send the request PATCH /api/user/wiener to the application again. In the Response section, we see that we have received valid access data from our user wiener.
In our request, we remove wiener from the first line. The request should now look like this.
If we send this request, we receive a HTTP/2 400 Bad Request response. In the body of the response we can see the reason for the error message. An identifier was expected and this was not sent.
Now let's remove /user from our path so that our request looks like this.
When we send the request, we receive an HTTP/2 302 Found response.
In Burp Repeater, click on the Follow redirection button.
Now move the mouse to the Response section and right-click, then select the option Show response in browser.
A window will open where we click on the Copy button.
Now open a new tab in your browser and paste the link you just copied. You will now see the API documentation and can delete the user Carlos.
We adjust our request with the following path: DELETE /api/user/carlos. The complete request looks like this.
When we send this request, we receive an HTTP/2 200 OK response, indicating that the user has been deleted.
The following message appears in the browser.
We have successfully completed the exercise.
Video solution
Last updated