Naked Labs

Tier 1 · Learn — one API, one vulnerability, one flag.

← All CAPIE labs

What is a naked lab? A naked lab is stripped to the bone: a couple of endpoints and exactly one exploitable flaw. No decoys, no rabbit holes. The goal is pure muscle memory — perform the raw technique for one OWASP API risk until you can do it in your sleep. Read the objective, exploit the one bug, grab the flag{}, move on. Together they cover the OWASP API Top 10 (2019 + 2023).

OWASP API Top 10 — 2023

API1:2023 Broken Object Level Authorization

BOLA

Access another user's object by tampering with an ID.

API2:2023 Broken Authentication

Broken Authentication

Escalate to admin by breaking token authentication.

API3:2023 Broken Object Property Level Authz

BOPLA

Manipulate object properties you shouldn't control.

API4:2023 Unrestricted Resource Consumption

Resource Consumption

Abuse an action that has no rate limiting.

API5:2023 Broken Function Level Authorization

BFLA

Invoke an admin-only function as a low-priv user.

API6:2023 Unrestricted Access to Business Flows

Business Flows

Automate a sensitive flow past its intended limit.

API7:2023 Server Side Request Forgery

SSRF

Make the API fetch an internal resource for you.

API8:2023 Security Misconfiguration

Security Misconfiguration

Find what insecure defaults quietly leak.

API9:2023 Improper Inventory Management

Improper Inventory

Discover an endpoint that should have been retired.

API10:2023 Unsafe Consumption of APIs

Unsafe Consumption

Feed the API bad data from an upstream it trusts.

Also covered — 2019 classics

2019 A08 Injection (SQL Injection)

Injection (SQLi)

Inject into a query the API builds unsafely.

2019 A10 Insufficient Logging & Monitoring

Logging & Monitoring

Break in without leaving a trace, then prove it.