IMPORTANT:AttackDefense Labs is included with a Pentester Academy subscription! Upgrade Now to access over 1800+ Labs.

Already a Pentester Academy student? Your access will continue uninterrupted. Please use the same Google account to login here.

Not a Pentester Academy student? Try our Free Communitiy Labs

[Retired] API Security and JWT CTF: [Oct 23-27]

weekly-ctf-all | Level: Easy  | Total Lab Runs: 0 | Premium Lab

Lab Scoreboard

This CTF contest has concluded. The solution PDF manual is provided above for your reference.

Welcome to our Weekly CTF Contest!

CTF Description:

As a developer, rate-limiting and user-input sanitization are the two most important controls that must be present in an API! It is also a good idea to keep the libraries updated, especially when there are security issues with the older versions!

With these mechanisms in place, a majority of the API's become secure!

In this CTF contest, you get access to a shopping web application. Break into the account of an authorized user and try to leverage issues with the backend API to exfiltrate data from the target machine and get adequate information to break into the target machine. Also leverage the backend API to escalate to root by some input sanitization bug. After getting into the target machine, interact with the API running on the other machine accessible from the target machine’s network. Bypass token checks, retrieve the admin token, leverage the tokens to exfiltrate data, and try to get the flag from that machine by leveraging the database!


Collect all ten flags.




  • Select the Server closest to you and click on RUN to start the lab (takes approximately 25s).

  • Click on LAB LINK to get a Kali GUI instance.

  • This lab is dedicated to you! No other users are on this network

  • The first target web application and the backend API should be available on the machine having IP address 192.X.Y.3.

  • The second target machine should be accessible from the machine where the first target web application is running. It would have the IP address 192.A.B.3. Run "ip a" to know the values of A and B.

  • Do not attack the gateway located at IP address 192.X.Y.1

  • Collect the 10 flags stored in the different places: FLAG1, FLAG2, FLAG3, /root/FLAG4 (on the first target machine containing the webapp), FLAG5, FLAG6, FLAG7, FLAG8, FLAG9, FLAG10


  • Capture and verify 10 flags - FLAG1, FLAG2, FLAG3, FLAG4, FLAG5, FLAG6, FLAG7, FLAG8, FLAG9, FLAG10.

  • Once you verify the flags, email with a short report on the process and the email you used to register on this website.

  • Reply to our Twitter or LinkedIn posts to let us know you've submitted your report. 

  • This CTF contest will start on 0000hrs Oct 23, 2020 ET and end on 2359hrs Oct 27, 2020 ET.

  • The first 3 correct submissions will get a 30-day subscription to PentesterAcademy.

  • An additional 3 correct submissions will also get a 30-day subscription to PentesterAcademy. These will be picked randomly from the remaining correct submissions coming in till 2359hrs Oct 27, 2020 ET. 

  • Winners will be contacted on Oct 28-29, 2020.

  • All decisions from our team will be final. 

1. FLAG1
2. FLAG2
3. FLAG3
4. FLAG4
5. FLAG5
6. FLAG6
7. FLAG7
8. FLAG8
9. FLAG9
10. FLAG10

The following activities are strictly prohibited on this website unless otherwise explicitly stated as allowed in the mission statement:

  • Using automated scanners
  • Using brute force attacks
  • Denial of Service attacks
  • Attacking other student machines in challenges where you might achieve a shell on the vulnerable system
  • Attacking the lab infrastructure

Users violating the above will be either temporarily or permanently banned from the website. 

If you are unsure about an activity, then please contact support to confirm that it is allowed on our website.

Technical Support for this Lab:

There is a reason we provide unlimited lab time: you can take as much time as you need to solve a lab. However, we realize that sometimes hints might be necessary to keep you motivated!

We currently provide technical support limited to:

  • Giving hints for a lab exercise
  • In rare circumstances, if you have totally given up (NO!!!) then tell you how to solve it. This will be limited to sharing the solution video or lab report
  • A lab exercise fails to load or has errors in it

If you need technical support, please email  clearly mention the name and link of the lab exercise and other essential details. The more descriptive you are, the faster we can help you. We will get back to you within 24 hours or less. 

For adminitrative queries, billing, enterprise accounts etc. please email