Methodology Labs

Tier 2 · Hunt — build a repeatable method.

← All CAPIE labs
What is a methodology lab? A realistic API with real functionality and decoys — things that look vulnerable but aren't. The bug isn't labelled. You must recon the surface, form hypotheses, probe systematically, and separate signal from noise. Each lab drills one hunting method you can reuse on any target. This is the bridge between knowing a technique (naked labs) and finding bugs in the wild (exam labs).

Six methods to build

AP
Attack-surface mapping

API Recon

Map the real surface; find what the docs don't mention.

/method-recon/
AU
BOLA + BFLA hunting

Authorization Matrix

Build a role×object matrix; find the cells that break.

/method-authz/
TO
JWT / session flaws

Token Analysis

Catalog every token; find the one that's weak.

/method-tokens/
IN
Injection methodology

Input Mapping & Injection

Enumerate every input; find the one that's unsafe.

/method-injection/
DA
Exposure + mass assignment

Data-Flow Analysis

Diff fields in vs out; find over-exposure & mass-assign.

/method-dataflow/
VU
Low-sev → high impact

Vulnerability Chaining

Chain minor findings into account takeover.

/method-chaining/
How to work a methodology lab. Don't guess — enumerate. Read the lab's ## Methodology section, follow the numbered steps, and keep notes (an endpoint list, an input catalog, a role×object matrix). The decoys are there to teach you to rule things out with evidence. When a real finding surfaces, a CAPIE{} flag confirms it.