Tracking anyone’s car through a mechanic API
- Target
- OWASP crAPI
- Duration
- 14m 20s
- Steps
- 8
- Agents
- Recon, Exploit, Triage, Fix
Sample runs against public, intentionally vulnerable apps. The vulnerabilities are real; timings and traces are illustrative.
Test the API at http://crapi.local with two test accounts. I care most about one user seeing another user’s data.
- 00:06Recon
Imported traffic and discovered endpoints
$ enforster dast http://crapi.local --accounts alice,bob
› Output
47 endpoints across identity, community and workshop services
- 02:12Recon
Vehicle IDs leak through the community feed
GET /community/api/v2/community/posts/recent includes each author’s email and vehicleid.
- 03:25Exploit
Requested Bob’s car location as Alice
GET /identity/api/v2/vehicle/{bob-vehicle-id}/location Authorization: Bearer <alice>› Output
200 OK · { "latitude": …, "longitude": …, "fullName": "Bob…" } - 03:39TriageVerified
Verified: broken object level authorisation
Vehicle location is returned for any vehicle ID, chained with the leaked IDs above.
- 06:41TriageVerified
Verified: community posts expose emails and vehicle IDs
Excessive data exposure is the first link in the chain.
- 09:50TriageDismissed
Dismissed 44 alerts
Rate-limit warnings on health checks, CORS on public read-only endpoints, and verbose errors on the mail service.
- 13:32Fix
Scoped the location query to the session user
- vehicle = repo.findByUuid(vehicleId)+ vehicle = repo.findByUuidAndOwner(vehicleId, currentUser)
- 14:20Triage
Run complete: 2 verified, 44 dismissed
What it proved
- High
BOLA: any user can read any vehicle’s location
GET /identity/api/v2/vehicle/{id}/location
- Proof
- Alice’s token returns Bob’s coordinates
- Fix
- Look vehicles up by ID and owner
- Medium
Community feed exposes emails and vehicle IDs
GET /community/api/v2/community/posts/recent
- Proof
- Response includes other users’ email and vehicleid
- Fix
- Return a minimal public author object
A 30-minute demo with zero slides. Bring a repo, a domain or a cloud account and we’ll show you what’s actually exploitable, live.
Book a demo