Need Help in API Attack Module

Hello, I could need help with the new module “API Attacks”. Im currently working at the topic “Security Misconfiguration” and the second task is called “Submit the header and its value that expose another Security Misconfiguration in the API”. I have worked on it for hours, and I still dont know what is wrong with the header:

Response headers {
content-type: application/json; charset=utf-8
date: Tue,16 Jul 2024 13:01:10 GMT
server: Kestrel
transfer-encoding: chunked
}

Please tell me what I am doing wrong, so I can proceed. Thanks in advance

1 Like

Perform test cases for CORS. You’ll get your answer there.

HI I am struggling with the Unrestricted Resource Consumption task.

Exploit another Unrestricted Resource Consumption vulnerability and submit the flag. The hint says focus on sms-otps. I do not understand the relevance of the otp-s to this topic. Can you give me some kind of a hint?

1 Like

Try changing the request method and observe changes in the response headers. You should see it

login with a email from a user and then spam that endpoint until you get the flag

This is the last question that I am stuck on, I’ve finished everything else in the module. I’ve tried to use external URLs for uploading files to trigger CORS via the API but I don’t see anything of interest returned in the headers.

Any help would be greatly appreciated!

Thanks.

I used curl for this.

Curl Request Without Origin Header
When you run the command without the Origin header:

curl -i http://94.237.54.201:41238/api/v1/suppliers/%27%20OR%201%3D%3D1%20--/count

The server recognizes the request as coming from the same origin (since it’s a direct request to the URL), and as a result, it does not include any CORS headers in the response.


When you include the Origin header:

curl -i -H "Origin: http://94.237.54.201:41238/" http://94.237.54.201:41238/api/v1/suppliers/%27%20OR%201%3D%3D1%20--/count

By adding the Origin header, you are simulating a request that looks like it is coming from a different origin (i.e., -H "Origin: *").

The server sees this request as a potential cross-origin request and responds with CORS headers and reveals the answer, which in this case indicates that it allows requests from any origin. Therefore, it is “another Security Misconfiguration in the API”.


Alternatively, instead of curl, you can do it within Firefox > Inspect

Hope you didn’t rip out all your hairs out. :smiling_face_with_three_hearts:

1 Like