API Abuse labs
API Abuse & GraphQL Attacks
What is API Abuse?
API Abuse vulnerabilities exploit REST and GraphQL API functionality beyond its intended use: rate limiting bypass, mass assignment, BOLA/BFLA, GraphQL introspection abuse, batch query attacks and enumeration via timing.
Why practice API Abuse?
APIs are the most common target in modern applications (mobile + web + B2B), and the OWASP API Top 10 is relatively recent — devs are still catching up. Typical bounty: BOLA and BFLA pay in the $1,000-$10,000 range per vulnerable endpoint.
What will you learn with the API Abuse labs?
You'll learn the OWASP API Top 10 hands-on (BOLA, BFLA, mass assignment, server-side request forgery via webhooks), GraphQL techniques (introspection, alias batching, query depth attacks), and rate-limiting bypass via X-Forwarded-For + endpoint variants.
Types of API Abuse we cover
- BOLA (Broken Object Level Auth)
The API equivalent of IDOR — you reach other people's objects by passing their ID. E.g.: GET /api/v1/orders/123.
- BFLA (Broken Function Level Auth)
Admin endpoints reachable by normal users. E.g.: POST /api/v1/users (create users) without a role check.
- GraphQL introspection
If __schema is enabled in prod, you map the whole API in one query — including hidden sensitive mutations.
- Mass assignment
PUT /users/me with `{role:"admin", verified:true}` — extra fields the model accepts without filtering.
- Rate limit bypass
Rotating X-Forwarded-For, IPv6 prefix variation, endpoint aliases (/api/v1 vs /api). Enables brute force.
How do you find and exploit API Abuse?
A practical playbook — from recon to proof of concept.
- 1
Map the API surface
Collect endpoints from mobile/web traffic, the Swagger/OpenAPI docs and old versions (/api/v1 vs /api/v2). The more complete the map, the more flaws you find.
GET /swagger.json · /api/v1/ · /api/internal/ - 2
Test BOLA on every object
Replay requests swapping the object ID for someone else's with your token. If it returns another user's data, it's Broken Object Level Authorization.
GET /api/v1/orders/1002 (your token, someone else's order) - 3
Test BFLA on admin functions
Call management operations (create/delete users, change roles) with a normal account. Many APIs don't re-check the function level.
POST /api/v1/admin/users {"role":"admin"} (with a basic token) - 4
Abuse mass assignment
Add privileged fields to the update body. If the model accepts them without an allowlist, you escalate privileges or skip verifications.
PATCH /api/v1/users/me {"isAdmin":true,"emailVerified":true} - 5
Exploit GraphQL
If introspection is on, dump the full schema and discover hidden mutations; with alias batching you brute force in a single request.
{__schema{types{name fields{name}}}} · alias1:login(...) alias2:login(...) ... - 6
Bypass the rate limit
Rotate the simulated IP, vary the path or casing, or batch attempts to skip throttling and enable brute force.
X-Forwarded-For: 1.2.3.4 (rotating) · /api/v1/login vs /API/V1/login
Learn the theory
Academy: GraphQL Security
Loading labs...
View in full catalog →Frequently asked questions
What is API Abuse?
It's the set of attacks that exploit REST and GraphQL APIs beyond their intended use: access to other people's objects (BOLA), uncontrolled admin functions (BFLA), mass assignment, GraphQL introspection abuse and rate-limiting bypass.
How is a vulnerable API exploited?
You intercept requests and manipulate object IDs (BOLA), call administrative endpoints with normal accounts (BFLA), add privileged fields to the body (mass assignment) and, in GraphQL, dump the schema with introspection to find sensitive mutations.
How do you find API flaws in bug bounty?
Capture the mobile/web app traffic, map endpoints with Swagger and old versions, and systematically test BOLA/BFLA with two accounts. In GraphQL, fire an introspection query to reveal the whole surface.
How do you prevent API abuse?
Apply object-level and function-level authorization on every endpoint, use a field allowlist on updates (avoid mass assignment), disable GraphQL introspection in production, limit query depth/cost, and apply robust rate limiting.
Difference between BOLA and BFLA?
BOLA (Broken Object Level Authorization) is reaching other users' OBJECTS by changing their ID — equivalent to IDOR. BFLA (Broken Function Level Authorization) is running FUNCTIONS you don't have the level for, like admin endpoints, from a normal account.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice API Abuse in real labs
Every API Abuse lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime