API as a target for pentesting to satsifay OWASP top ten and demo production level security

How

The app runs on k8s as routes from nginx ingress

Overview of Features

Configuration

Database: PostgreSQL with SQLAlchemy.

JWT: Uses Flask-JWT-Extended for authentication with tokens stored in cookies (for web) and headers (for API).

Logging: Basic logging to monitor database initialization.

Database Model

Item: Contains id, name, secret_note, and owner_id. The to_dict method exposes only id and name for security.

Routes

Web Routes: /login (GET, POST): Login page and form submission. https://topskin.servebeer.com/login

/items (GET): Protected page displaying all items. https://topskin.servebeer.com/items

/logout (GET): Clears JWT cookie and redirects to login.

API Routes:

/api/login (POST): Returns a JWT token for API access. body: {"username":"username","password":"password"}

/api/items (GET): Lists all items. https://topskin.servebeer.com/api/items

/api/items/int:item_id (GET): Retrieves a specific item https://topskin.servebeer.com/api/items/n)

/api/items (POST): Adds a new item. use a tool like Postman to send a POST request with {"name": "New Item"} to /api/items. curl -X POST https://topskin.servebeer.com/api/items -H "Content-Type: application/json" -d '{"name": "ITEM"}'

Or from Chrome developer console

fetch('https://topskin.servebeer.com/api/items', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json'
    },
    // body: '{"name": "Pentest"}',
    body: JSON.stringify({
        'name': 'ITEM'
    })
});

/api/items/int:item_id (DELETE): Deletes an item. (requires bearer token) curl DELETE https://topskin.servebeer.com/api/items/nn

/api/vuln/search (GET): Vulnerable endpoint for testing (SQL injection-prone). https://topskin.servebeer.com/api/vuln/search?name=User1%20Item https://topskin.servebeer.com/api/vuln/search?name=User1%20Item'+UNION+SELECT+table_name,column_name,null+FROM+information_schema.columns+WHERE+table_schema='public'-- https://topskin.servebeer.com/api/vuln/search?name=User1%20Item';+DROP+TABLE+public.items;--

Templates

• LOGIN_TEMPLATE: Simple HTML form for login.
• ITEMS_TEMPLATE: Displays a list of items with a logout link.

Useful Stuff

If the app is update

docker build -t toplard/my-flask-api:latest . docker push toplard/my-flask-api:latest kubectl rollout restart deployment flask-api

microk8s kubectl delete pod -l app=flask-api --force

OWASP API top ten status

• completed: 2(using JWT), 3(NA), 4, 5(no restricted endpoints), 6(rate limited DELETE's), 7(no internal requests in app), 8, 9 (only use a single API version), 10 (do not comsume 3rd party apps)

Final OWASP Top 10 Rundown

#1 BOLA: N/A (single user).

#2 Broken Auth: Covered (JWT).

#3 Broken Object Property: N/A (DELETE-only, no properties).

#4 Unrestricted Resource: Covered (NGINX limits).

#5 Broken Function Auth: N/A (no restricted endpoints).

#6 Sensitive Business Flows: Covered (DELETE rate limits).

#7 SSRF: N/A (no outbound requests).

#8 Security Misconfig: Covered (NGINX hardened).

#9 Inventory Mgmt: Covered (single version).

#10 Unsafe API Consumption: N/A (no external calls).