Testing the account provisioning process via the REST API
Account provisioning is the process of establishing and maintaining user accounts within an application. Provisioning capabilities are usually restricted to administrator accounts. Penetration testers must validate that account-provisioning functions are only available to users with proper identification and authorization. A common venue for account provisioning is through REST API calls. Many times, developers may not put the same authorization checks in place for API calls that are used in the UI portion of an application.
Getting ready
Using REST API calls available in the OWASP Mutillidae II application, determine whether any unauthenticated API calls exist and whether such calls can provision or modify users.
How to do it...
Make sure you are not logged in to the application. If you are, click the Logout button from the top menu. Now, follow these steps:
- Within Mutillidae, browse to the User Lookup ...
