Technical requirement
To better understand the practical aspect of bypassing authentication and authorization in APIs, we will install and configure a vulnerable API. Steps on how to install the API locally can be found on the README page of the GitHub repository: https://github.com/PacktPublishing/API-Security-for-White-Hat-Hackers/blob/main/BreachMe-API/README.md. Once you are done installing and setting up the API, you should see something like the following.
Figure 6.1 – Starting our vulnerable API
To interact with the API, we will use Postman to visit http://localhost:3030/. You can also create a new collection and name it what you want. Also, we will be grouping our requests into three folders, Auth, Users, and Transactions, so be sure to create them.
Figure 6.2 – New collection
We are now set to begin our testing.
