Hamcodes Labs
Home/Catalogue/API Security
Exercise domain

API Security

6 drills · 0 playable free, no sign-up

APIs fail differently from the pages in front of them. These exercises target the OWASP API Top 10 directly: the endpoint that trusts an id, the field the client should never set, the key that unlocks the whole tenant. Built for backend and platform engineers.

OWASP API Top 10CWE Top 25OWASP ASVS
In build

The id you can change

GET /orders/1002 returns your order. So does 1003. Learn broken object-level authorization, the number one API risk, and the fix.

OWASP API1CWE-639
In buildCore · 8 min
In build

Mass assignment

The profile update accepts whatever JSON you send, including role: admin. See mass assignment escalate, and lock the fields down.

OWASP API3CWE-915
In buildCore · 7 min
In build

No rate limit, no mercy

A login endpoint answers as fast as you can ask. Watch credential stuffing run unchecked, then add the limits that stop it.

OWASP API4CWE-770
In buildFoundational · 6 min
In build

The over-privileged key

One API key does everything for every tenant, and it is in a mobile app. Learn scoping, rotation, and least privilege for keys.

OWASP API5CWE-522
In buildCore · 7 min
In build

Data the endpoint should not return

The user endpoint returns password hashes and internal flags because the client "only shows the name". Trim the response at the source.

OWASP API3CWE-213
In buildCore · 7 min
In build

The forgotten v1 endpoint

An old, unpatched API version is still live and still trusted. See why an inventory of endpoints is a security control.

OWASP API9ISO A.8.9
In buildAdvanced · 8 min
How to play these. Each drill with a Play exercise link opens straight into that scenario in the 3D sim: finish it, then come back and pick another, or hit Play the full track to run them back to back. Drills marked In the program ship with the guided rollout. Book a demo for the full library.