crAPI Guide for API Security Testing

August 31, 2022

crAPI (Completely Ridiculous API) is an intentionally vulnerable application developed to help developers, security researchers, and penetration testers learn about common API security weaknesses. It provides a practical environment for exploring the OWASP API Security Top 10 and understanding how insecure API implementations can expose sensitive data or allow unauthorized actions.

Built with a modern microservices architecture, crAPI simulates an application for people buying and managing their first car. Users can register, interact with application features, and investigate security flaws through hands-on exercises. Since the vulnerabilities are deliberately included for training, crAPI is suitable for security labs when deployed in an isolated environment.

For more information, visit the official OWASP crAPI project on GitHub.

Key Features of crAPI

API security training: Explore common API vulnerabilities through practical scenarios.
Realistic application design: Learn how API weaknesses affect a microservices-based application.
Hands-on testing: Practice inspecting requests, responses, authentication, authorization, and application behavior.
OWASP alignment: Use the lab to understand risks such as broken object-level authorization, broken authentication, and excessive data exposure.
Containerized deployment: Run the application with Docker Compose for a repeatable training environment.

Quick Start Guide

Prerequisites

Install Docker and Docker Compose on the host machine before deploying crAPI. Ensure Docker is running and that the system has enough resources to start the application’s containers.

Deploy the Latest Stable Version

The following steps download the Docker Compose configuration, retrieve the required images, and start the application in the background.

Linux

curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/main/deploy/docker/docker-compose.yml
docker-compose pull
docker-compose -f docker-compose.yml --compatibility up -d

Windows

curl.exe -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/main/deploy/docker/docker-compose.yml
docker-compose pull
docker-compose -f docker-compose.yml --compatibility up -d

Depending on your installation, the Docker Compose V2 command may be docker compose instead of docker-compose. Use the command supported by your system.

Deploy the Development Version

The development branch contains changes that may not yet be included in a stable release. Use it when you specifically need to test the latest development features.

Linux

curl -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/develop/deploy/docker/docker-compose.yml
VERSION=develop docker-compose pull
VERSION=develop docker-compose -f docker-compose.yml --compatibility up -d

Windows Command Prompt

curl.exe -o docker-compose.yml https://raw.githubusercontent.com/OWASP/crAPI/develop/deploy/docker/docker-compose.yml
set "VERSION=develop"
docker-compose pull
docker-compose -f docker-compose.yml --compatibility up -d

Check the official repository for current setup instructions and supported Docker Compose commands before deploying. Development images may change and can be less stable than released versions.

Practice API Security in a Controlled Lab

After deployment, follow the project’s documentation to access the application and begin the exercises. Use an intercepting proxy or API testing client to inspect requests and responses, compare user permissions, and investigate how the application handles authentication and authorization.

Keep crAPI isolated from public networks and production systems. The application is intentionally vulnerable, so do not expose it to the internet or use real personal information or credentials during exercises.

For additional web reconnaissance practice, explore our guide to website OSINT tools and techniques. Combine controlled API testing with secure coding reviews to better understand how vulnerabilities arise and how to prevent them.