Copilotfree, in-browser
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
Ask me anything about your lessons or your code.
“What is a port?” · “Why is my code erroring?”
A deliberately vulnerable REST API. Learn how APIs actually get broken.
VAmPI is a small built with Flask, seeded on purpose with the API bugs that show up in real breaches. There is no UI to click. You talk to it with curl, HTTPie, or Burp, which is exactly how you test an API in the field. It ships in a deliberately vulnerable mode, so the flaws are switched on and waiting.
Your two objectives here: make the API act on an object that belongs to another user (user), then take over an account by abusing its broken ().
You are running this on your own machine. That is the only reason it is legal to attack it. Never point these techniques at an API you do not own or have written permission to test.
Docker and bring-your-own-VM boxes use proof revealed through the hints once you have genuinely completed the objective. Capture a flag by doing the work, then submitting the token. Phase B hosted machines will issue real per-instance flags planted on the target.
Start the container and confirm the API answers at http://localhost:5000.
Before anything else, call GET /createdb once to build and seed the database,
or every route will come back empty. Then work the objectives below. Use the
hints if you stall; each one costs a few points, so try on your own first.
Spin this up locally with Docker, then attack it from your Kali box.
$docker run --rm -p 5000:5000 erev0s/vampiThen hit it at http://localhost:5000/