APIIntermediateVulnerable Bank
Hacking Vulnerable Bank API — Part 1
Financial API assessment demonstrating BOLA, mass assignment, and authentication weaknesses.
15 min read→ User → Admin
Executive Summary
- Vulnerability Chain
- Registration → BOLA on accounts → mass assignment → auth bypass → admin access
- Impact
- Full account takeover and unauthorized financial data access.
- Methodology
- API endpoint enumeration, authorization testing, and parameter tampering.
Key Findings
| ID | Finding | Severity | Type |
|---|---|---|---|
| VB1 | Broken Object Level Authorization on account endpoints | Critical | BOLA |
| VB2 | Mass assignment on user registration | High | Mass Assignment |
Related Assessments
Hacking Damn Vulnerable Restaurant
[Placeholder] Step-by-step walkthrough exploiting BOLA, weak JWT secrets, username enumeration, and command injection leading to root access.
vAPI Walkthrough — Part I
[Placeholder] First half of complete vAPI lab walkthrough covering BOLA, broken authentication, and excessive data exposure.