VAmPI - Vulnerable REST API with OWASP top 10 vulnerabilit

项目说明

VAmPI

The API *(Based on OpenAPI 3)*
!vampi

![Docker Image CI]() !Docker Pulls

VAmPI is a API made with Flask and it includes from the OWASP top 10 for APIs. It was created as I wanted a API to e the efficiency of tools used to detect security issues in APIs. It includes a switch on/off to allow the API to be or not while testing. This allows to co the cases for false positi. VAmPI can also be used for learning/teaching purposes. You can find a bit more details about the in erev0s.com.

#### Features
- Based on OWASP Top 10 for APIs.
- OpenAPI3 specs and Postman Collection included.
- Global switch on/off to have a en or not.
- Token-Based Authentication (Adjust lifetime from within app.py)
- A Swagger UI to directly interact with the API

VAmPI's flow of actions is going like this: an unregistered user can see minimal information about the dummy users included in the API. A user can register and then login to be allowed using the token recei login to post a book. For a book posted the data accepted are the title and a secret about that book. Each book is unique for every user and only the owner of the book should be allowed to view the secret.

A quick rundown of the actions included can be seen in the following table:

| Action | Path | Details |
|:----------:|:-----------------------------:|:--------------------------------------------------:|
| GET | /createdb | Creates and populates the database with dummy data |
| GET | / | VAmPI home |
| GET | /me | Displays the user that is logged in |
| GET | /users/v1 | Displays all users with basic information |
| GET | /users/v1/_debug | Displays all details for all users |
| POST | /users/v1/register | Register new user |
| POST | /users/v1/login | Login to VAmPI |
| GET | /users/v1/{username} | Displays user by username |
| DELETE | /users/v1/{username} | Deletes user by username (Only Admins) |
| PUT | /users/v1/{username}/email | Update a single users email |
| PUT | /users/v1/{username}/password | Update users password |
| GET | /books/v1 | Retrieves all books |
| POST | /books/v1 | Add new book |
| GET | /books/v1/{book} | Retrieves book by title along with secret |

For more details you can either run VAmPI and visit or use a service like the swagger editor supplying the OpenAPI specification which can be found in the directory openapi_specs.

#### List of
- SQLi Injection
- Unauthorized Password Change
- Broken Object Le
- Mass Assignment
- Excessive Data Exposure through debug endpoint
- User and Password Enumeration
- RegexDOS (Denial of Service)
- Lack of Resources & Rate Limiting
- JWT authentication bypass via weak signing key

## Run it
It is a Flask application so in order to run it you can install all requirements and then run the app.py.
To install all requirements simply run pip3 install -r requirements.txt and then python3 app.py.

Or if you prefer you can also run it through docker or docker compose.

#### Run it through Docker

- A in Dockerhub
~~~~
docker run -p 5000:5000 erev0s/vampi:latest
~~~~

[Note: if you run Docker on newer of the MacOS, use -p 5001:5000 to avoid conflicting with the AirPlay Recei. Alternatively, you could disable the AirPlay Recei in your System Preferences -> Sharing settings.]

#### Run it through Docker Compose
docker-compose contains two instances, one instance with the secure configuration on port 5001 and another with insecure on port 5002:
~~~~
docker-compose up -d
~~~~

A Swagger UI :rocket:

Visit the path /ui where you are running the API and a Swagger UI will be a to help you get started!
~~~~

~~~~

Customizing token timeout and en or not

If you would like to alter the timeout of the token created after login or if you want to change the en not to be then you can use a few ways depending how you run the application.

- If you run it like normal with python3 app.py then all you have to do is edit the alive and vuln defined in the app.py itself. The alive is measured in seconds, so if you put 100, then the token expires after 100 seconds. The vuln is like boolean, if you set it to 1 then the application is , and if you set it to 0 the application is not .
- If you run it through Docker, then you must either pass en to the docker run command or edit the Dockerfile and rebuild.
- Docker run example: docker run -d -e =0 -e tokentimetolive=300 -p 5000:5000 erev0s/vampi:latest
- One nice feature to running it this way is you can startup a 2nd container with =1 on a different port and flip easily between the two.

- In the Dockerfile you will find two en being set, the EN=1 and the EN=60. Feel free to change it before running the docker build command.

Frequently asked questions

- There is a database error upon reaching endpoints!
- Make sure to issue a request towards the endpoint /createdb in order to populate the database.

Picture from freepik - www.freepik.com

项目信息

开发语言：Python

Star 数：1335

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Vulnerable REST API with OWASP top 10 vulnerabilities for security testing展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。