Starting from:
$115
CS6035 API Solution
FLAG 2: Stolen Credentials (15 pts)
In order to get this flag you need to create a new reviewer in the system. Unfortunately, the developers locked down this functionality some time ago so you’ll need an auth token in order to perform it. You read in the newspaper last week that Programming Reviews LLC had a big data breach so there is a good chance you can come across some credentials.
To earn your flag you must perform the following actions.
1 Use Swagger to find and call/invoke a suitable API endpoint that you feel can create new reviewers.
2 The API requires a token but in order to get a token you need to find suitable credentials. Use the APIs available to you to find these.
3 Now that you’ve found the credentials you need to get that token. Be sure to call/invoke the “flag2token” to get your token.
4 Armed with your token, call the API endpoint once more. Create a new reviewer with user name = “daylight” and full name = “Day Light” and your flag will be revealed.
Hints:
• Remember there was a data breach. I bet you can find suitable credentials somewhere.
• Looking for that ClientID? Be sure to follow all directions and inspect any response that the API
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag2.html :22
is sending back.
• In order to pass in the token you’ll need to set the Authorization Bearer header. Swagger has not been configured to do this. We suggest you use a tool called Postman. This is a very popular web API testing client. You can find more information here: https://learning.postman.com/docs/getting-started/introduction/
• You can also use Curl if you’re more comfortable with the command line. We do recommend you at least look at Postman since it will make your life much easier for this project and it’s very popular.
• Postman is already installed on the VM we have provided.
Include your flag2 into the json file and now onto Flag 3!
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag2.html :22
Flag 5: Hack JWTs pt. 2
FLAG 5: Hack JWTs - #2 (20 pts)
You’ve learned about a new experimental programming language that is TOP SECRET! This language only requires 1 single keyword to find a polynomial time algorithm to solve any NP-hard problem! You want the 1 million dollar reward for solving this problem and thus need access to this programming language. Find the language.
To earn your flag you must perform the following actions.
1 The programming language is not returned in normal API calls. In order to see this magical new language you need to leverage the “Top Secret” GET request.
2 Grab your normal JWT token from the “flag5token” API. Use these credentials: username is “Jackson5587” and password is “Blasphemy2”
3 You have the token so why not try to give it a shot? Try to use this token to view Top Secret languages.
• 403 - Forbidden. You need more help…
4 Inspect this token. You’ve learned through “insider program language trading” that in order to see TOP SECRET languages you need to provide the following JWT Claim.
• Claim Name: TOP_SECRET
• Claim Value: allowed
5 Alter your token and try it again
• Hmm, it appears that the server is correctly verifying the signature to ensure it hasn’t been tampered with. Rats!
6 Good news, the developers of this API are pretty bad at securing safe things like secret keys. Find the secret key.
7 With the key in hand, properly construct the JWT token with the TOP_SECRET claim.
8 Leverage your token to finally view the source code of the experimental programming language to earn your 1 million dollars and the flag.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag5.html :24
Hints:
• You need to find the key that’s used to verify the JWT signature. Search through the APIs to see if you can find a trail that leads to it.
• You need to construct a valid JWT token. You can leverage tools and websites such as jwt.io to perform this or handle it manually. This choice is up to you.
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag5.html :24
Flag 1: Swagger Intro
FLAG 1: Swagger Intro (10 pts)
This flag will introduce you to basic API functionality using a documentation and test harness tool called Swagger. Swagger is a very popular tool used to develop and test web APIs and has plugins/modules in most programming languages. You can learn more about Swagger here: https://swagger.io/
You’ll need to leverage Swagger (or any other http tool you desire such as curl or Postman) to determine how the API is configured and what endpoints to invoke to earn this flag.
To earn your flag you must perform the following actions by making API calls.
1 Create a new Programming Language that IS featured and is named “SpaceScript++”
2 Create a review of the new SpaceScript++ language. The title should be “A Galactic Odyssey in
Code, enhanced”, rating is 4 and the reviewer is “Kara Thrace”
3 Reply to the new review by Kara Thrace. The replier should be “Gaius Baltar” and the body “Fascinating, but lacks a certain logical coherence.”
4 Finally, delete the new programming language you created and your flag will be revealed. https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag1.html :21
Hints:
• The GATECH_ID header is required and enforced as such by the Swagger UI test harness.
• Choose any value for fields not explicitly stated above.
• Do not include extra quotes or double quotes embedded within the actual value.
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag1.html :21
Flag 3: JWT Intro
FLAG 3: JWT Intro (15 pts)
Now that you’ve used an Auth token we’re going to dig a bit deeper into JWT (JSON Web Tokens). This flag is simple and designed only to get you acquainted with how JWTs are constructed. There are numerous resources to help you work with JWTs, one we recommend is https://jwt.io/ but you are not required to use this site for the project. Choose any library, tool or site you wish to inspect and construct JWT tokens.
To earn your flag you must perform the following actions.
1 Call/invoke the “flag3token” GET API to get your token.
2 Parse the token using a tool of your choice.
3 Use values from the token to craft the correct payload and POST that to the “flag3token” API for your flag.
Hints:
• The intent of this flag is to get you familiar with the JWT token structure. You will need to understand what it is and how to construct/deconstruct these. This will likely require some outside research on your part.
The next few flags will require some trial and error and a bit of research on your part to
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag3.html
succeed. Your task is to craft JWT tokens such that you can use the token to successfully authenticate and earn your flag.
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag3.html
Flag 4: Hack JWTs pt. 1
FLAG 4: Hack JWTs - #1 (15 pts)
You are a PHP ninja! You can’t get enough of this language. When you learned that others hate it and gave it bad reviews you felt the need to “correct the situation”. You’ve learned of an API that allows you to delete reviews. Muhahahah! The problem is that only the site moderator can do this and you don’t have his credentials. This has not stopped you in the past.
To earn your flag you must perform the following actions.
1 Find the suitable API that will allow you to accomplish your goal above.
2 You have previously registered with the site as a “reviewer” and remember your username is “python_guru1” and password is “The_sql_injection_vulnerabilities_are_false”. Use these to get your token from the “flag4token” API.
3 Analyze the token and do research to find a way to “upgrade” your token so that you can fool the API into thinking you are a “moderator”.
4 Leverage your newly crafted token to delete all of those incriminating PHP reviews and earn your flag.
Hints:
• Maybe inspecting your token will give you a clue of how the server is handling authorization.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag4.html
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time. https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag4.html
Flag 6: Hack JWTs pt. 3
FLAG 6: Hack JWTs - #3 (15 pts)
You’ve been informed that the system has a weak key vulnerability that can be decrypted using a brute-force attack. The weak key corresponds to the employee ID of one of the developers who developed the code, assuming that no one could guess the employee ID.
A friendly employee in the company has leaked the pattern for the employee ID number, which would consist of numeric digits and could be up to seven digits. Pass this weak key on to the flag6 API and you should get the flag.
To earn your flag you must perform the following actions.
1 Invoke the flag6token API to get the vulnerable token with a weak key.
2 Once you have the jwt token, carefully analyze the token header and the contents and note it down.
3 Explore various possibilities to hack into the JWT token. Various open source tools can be used to decrypt a weak key. You are free to explore any of these tools or write your code to decrypt the token.
4 Once you have decrypted the weak key, you need to use this weak key to get access to the API endpoint reserved for third party usage. Go over the swagger documentation to look out for this endpoint.
5 Once you have the endpoint, pass the weak key as path param to the flag6 API. Once you have done this, you should have the flag as shown in the image below.
Hints:
• The encryption algorithm used in the weak key generation would help to identify the right technique to decipher the weak key.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag6.html
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time. https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag6.html
Flag 7: Broken Access Control
Flag 7: Broken Access Control (10 pts)
To earn your flag you must perform the following actions.
1 Find an API in Swagger that gives you details of the current user. Inspect the response and take note of any notable identifiers.
2 Given the endpoints available, see if the user ID and additional API endpoints help give insights to find the admin profile.
3 Invoke the reset-password API to change the admin user’s password. The new password value doesn’t matter.
Hints:
• All profiles will be under the UserProfile APIs in Swagger which are prefixed with /profiles
• How do most database identifier fields work? Does the data from responses give you any ideas?
Resources:
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag7.html
• OWASP Top 1: Broken Access Control - https://owasp.org/Top10/A01_2021Broken_Access_Control/
• Gibson Security write up on broken access control in Snapchat https://gibsonsec.org/snapchat/
• Facebook business pages broken access control example: https://thezerohack.com/hackingfacebook-pages
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag7.html
In order to get this flag you need to create a new reviewer in the system. Unfortunately, the developers locked down this functionality some time ago so you’ll need an auth token in order to perform it. You read in the newspaper last week that Programming Reviews LLC had a big data breach so there is a good chance you can come across some credentials.
To earn your flag you must perform the following actions.
1 Use Swagger to find and call/invoke a suitable API endpoint that you feel can create new reviewers.
2 The API requires a token but in order to get a token you need to find suitable credentials. Use the APIs available to you to find these.
3 Now that you’ve found the credentials you need to get that token. Be sure to call/invoke the “flag2token” to get your token.
4 Armed with your token, call the API endpoint once more. Create a new reviewer with user name = “daylight” and full name = “Day Light” and your flag will be revealed.
Hints:
• Remember there was a data breach. I bet you can find suitable credentials somewhere.
• Looking for that ClientID? Be sure to follow all directions and inspect any response that the API
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag2.html :22
is sending back.
• In order to pass in the token you’ll need to set the Authorization Bearer header. Swagger has not been configured to do this. We suggest you use a tool called Postman. This is a very popular web API testing client. You can find more information here: https://learning.postman.com/docs/getting-started/introduction/
• You can also use Curl if you’re more comfortable with the command line. We do recommend you at least look at Postman since it will make your life much easier for this project and it’s very popular.
• Postman is already installed on the VM we have provided.
Include your flag2 into the json file and now onto Flag 3!
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag2.html :22
Flag 5: Hack JWTs pt. 2
FLAG 5: Hack JWTs - #2 (20 pts)
You’ve learned about a new experimental programming language that is TOP SECRET! This language only requires 1 single keyword to find a polynomial time algorithm to solve any NP-hard problem! You want the 1 million dollar reward for solving this problem and thus need access to this programming language. Find the language.
To earn your flag you must perform the following actions.
1 The programming language is not returned in normal API calls. In order to see this magical new language you need to leverage the “Top Secret” GET request.
2 Grab your normal JWT token from the “flag5token” API. Use these credentials: username is “Jackson5587” and password is “Blasphemy2”
3 You have the token so why not try to give it a shot? Try to use this token to view Top Secret languages.
• 403 - Forbidden. You need more help…
4 Inspect this token. You’ve learned through “insider program language trading” that in order to see TOP SECRET languages you need to provide the following JWT Claim.
• Claim Name: TOP_SECRET
• Claim Value: allowed
5 Alter your token and try it again
• Hmm, it appears that the server is correctly verifying the signature to ensure it hasn’t been tampered with. Rats!
6 Good news, the developers of this API are pretty bad at securing safe things like secret keys. Find the secret key.
7 With the key in hand, properly construct the JWT token with the TOP_SECRET claim.
8 Leverage your token to finally view the source code of the experimental programming language to earn your 1 million dollars and the flag.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag5.html :24
Hints:
• You need to find the key that’s used to verify the JWT signature. Search through the APIs to see if you can find a trail that leads to it.
• You need to construct a valid JWT token. You can leverage tools and websites such as jwt.io to perform this or handle it manually. This choice is up to you.
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag5.html :24
Flag 1: Swagger Intro
FLAG 1: Swagger Intro (10 pts)
This flag will introduce you to basic API functionality using a documentation and test harness tool called Swagger. Swagger is a very popular tool used to develop and test web APIs and has plugins/modules in most programming languages. You can learn more about Swagger here: https://swagger.io/
You’ll need to leverage Swagger (or any other http tool you desire such as curl or Postman) to determine how the API is configured and what endpoints to invoke to earn this flag.
To earn your flag you must perform the following actions by making API calls.
1 Create a new Programming Language that IS featured and is named “SpaceScript++”
2 Create a review of the new SpaceScript++ language. The title should be “A Galactic Odyssey in
Code, enhanced”, rating is 4 and the reviewer is “Kara Thrace”
3 Reply to the new review by Kara Thrace. The replier should be “Gaius Baltar” and the body “Fascinating, but lacks a certain logical coherence.”
4 Finally, delete the new programming language you created and your flag will be revealed. https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag1.html :21
Hints:
• The GATECH_ID header is required and enforced as such by the Swagger UI test harness.
• Choose any value for fields not explicitly stated above.
• Do not include extra quotes or double quotes embedded within the actual value.
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag1.html :21
Flag 3: JWT Intro
FLAG 3: JWT Intro (15 pts)
Now that you’ve used an Auth token we’re going to dig a bit deeper into JWT (JSON Web Tokens). This flag is simple and designed only to get you acquainted with how JWTs are constructed. There are numerous resources to help you work with JWTs, one we recommend is https://jwt.io/ but you are not required to use this site for the project. Choose any library, tool or site you wish to inspect and construct JWT tokens.
To earn your flag you must perform the following actions.
1 Call/invoke the “flag3token” GET API to get your token.
2 Parse the token using a tool of your choice.
3 Use values from the token to craft the correct payload and POST that to the “flag3token” API for your flag.
Hints:
• The intent of this flag is to get you familiar with the JWT token structure. You will need to understand what it is and how to construct/deconstruct these. This will likely require some outside research on your part.
The next few flags will require some trial and error and a bit of research on your part to
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag3.html
succeed. Your task is to craft JWT tokens such that you can use the token to successfully authenticate and earn your flag.
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag3.html
Flag 4: Hack JWTs pt. 1
FLAG 4: Hack JWTs - #1 (15 pts)
You are a PHP ninja! You can’t get enough of this language. When you learned that others hate it and gave it bad reviews you felt the need to “correct the situation”. You’ve learned of an API that allows you to delete reviews. Muhahahah! The problem is that only the site moderator can do this and you don’t have his credentials. This has not stopped you in the past.
To earn your flag you must perform the following actions.
1 Find the suitable API that will allow you to accomplish your goal above.
2 You have previously registered with the site as a “reviewer” and remember your username is “python_guru1” and password is “The_sql_injection_vulnerabilities_are_false”. Use these to get your token from the “flag4token” API.
3 Analyze the token and do research to find a way to “upgrade” your token so that you can fool the API into thinking you are a “moderator”.
4 Leverage your newly crafted token to delete all of those incriminating PHP reviews and earn your flag.
Hints:
• Maybe inspecting your token will give you a clue of how the server is handling authorization.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag4.html
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time. https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag4.html
Flag 6: Hack JWTs pt. 3
FLAG 6: Hack JWTs - #3 (15 pts)
You’ve been informed that the system has a weak key vulnerability that can be decrypted using a brute-force attack. The weak key corresponds to the employee ID of one of the developers who developed the code, assuming that no one could guess the employee ID.
A friendly employee in the company has leaked the pattern for the employee ID number, which would consist of numeric digits and could be up to seven digits. Pass this weak key on to the flag6 API and you should get the flag.
To earn your flag you must perform the following actions.
1 Invoke the flag6token API to get the vulnerable token with a weak key.
2 Once you have the jwt token, carefully analyze the token header and the contents and note it down.
3 Explore various possibilities to hack into the JWT token. Various open source tools can be used to decrypt a weak key. You are free to explore any of these tools or write your code to decrypt the token.
4 Once you have decrypted the weak key, you need to use this weak key to get access to the API endpoint reserved for third party usage. Go over the swagger documentation to look out for this endpoint.
5 Once you have the endpoint, pass the weak key as path param to the flag6 API. Once you have done this, you should have the flag as shown in the image below.
Hints:
• The encryption algorithm used in the weak key generation would help to identify the right technique to decipher the weak key.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag6.html
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time. https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag6.html
Flag 7: Broken Access Control
Flag 7: Broken Access Control (10 pts)
To earn your flag you must perform the following actions.
1 Find an API in Swagger that gives you details of the current user. Inspect the response and take note of any notable identifiers.
2 Given the endpoints available, see if the user ID and additional API endpoints help give insights to find the admin profile.
3 Invoke the reset-password API to change the admin user’s password. The new password value doesn’t matter.
Hints:
• All profiles will be under the UserProfile APIs in Swagger which are prefixed with /profiles
• How do most database identifier fields work? Does the data from responses give you any ideas?
Resources:
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag7.html
• OWASP Top 1: Broken Access Control - https://owasp.org/Top10/A01_2021Broken_Access_Control/
• Gibson Security write up on broken access control in Snapchat https://gibsonsec.org/snapchat/
• Facebook business pages broken access control example: https://thezerohack.com/hackingfacebook-pages
Disclaimer: You are responsible for the information on this website. The content is subject to change at any time.
https://github.gatech.edu/pages/cs6035-tools/cs6035-tools.github.io/Projects/API_Security/flag7.html
1 file (505.7KB)
