> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/api-testing/lab-1.md).

# Lab 1

<figure><img src="/files/tVkB9kjiUWVQT3cmepWz" alt=""><figcaption></figcaption></figure>

First thing I did was check out the /api

<figure><img src="/files/H6gN57sbGGxRQtWmKk6q" alt=""><figcaption></figcaption></figure>

Then used burp suite to check if updating the email did anything:

<figure><img src="/files/j19fApPtT8A8ldbF2K9B" alt=""><figcaption></figcaption></figure>

Looked up /user/wiener

<figure><img src="/files/6Wu5PgYDEsn6cXP6C6yz" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/vqbnIjK7eTt7B8MRC2F8" alt=""><figcaption></figcaption></figure>

Looked up /user: we need a input

So if we need a input, we need a user. Like Carlos?&#x20;

<figure><img src="/files/QONGcucy1wVCzbvT4v4H" alt=""><figcaption></figcaption></figure>

Searched it up, and we did get his email. But here's a thing:&#x20;

### What prevents this online?&#x20;

This type of vulnerability is called a IDOR

{% hint style="info" %}
**Insecure Direct Object Reference** — when an app exposes internal objects (users, files, records) via a predictable identifier and doesn't check if *you're allowed* to access that specific one.

***

{% endhint %}

What actually stops this in a real app

1. Authentication check Every request to /api/user/:username should verify a valid session/JWT token is present. No token = 401.
2. Authorization check (the one that's usually missing) Even with a valid token, the server should verify: requesting\_user == carlos OR requesting\_user.role == admin If not → 403. This is the check that's almost always the vuln.
3. Use opaque IDs instead of usernames /api/user/a3f9c2... (UUID) instead of /api/user/carlos makes enumeration much harder — though not a substitute for auth.

### Solving It&#x20;

<figure><img src="/files/pEIQ8zz2P0owmuhoOzYV" alt=""><figcaption></figcaption></figure>

If we try using his email - the email is not available. The solution to this lab was just going the /api and pressing delete.&#x20;