Skip to content
ctfpal
For instructors

Lesson pack 15 · Core · 90 minutes

APIs, GraphQL and application logic

The bugs that live between endpoints rather than inside one: object references, mass assignment, over-broad queries, and workflows that can be run out of order.

Print this page for a paper plan - the navigation and links drop out.Student-facing version

Before the session

  • Nothing to install. Students need a browser and https://ctfpal.com. Confirm the room can reach it once; after that it works offline.
  • Read the lesson yourself first - about 11 minutes.
  • Have one worked example ready to paste. The classroom link builder on the instructor page turns it into a URL that opens preloaded.

Objectives

Written as things a student can do afterwards, so they can be assessed rather than asserted.

  1. Enumerate an API's real surface from a specification, a client bundle, or introspection
  2. Test an object reference for authorisation rather than for existence, using two accounts
  3. Find a mass-assignment field by diffing what the API returns against what it accepts
  4. Query a GraphQL schema for the fields the UI never asks for, and measure the cost of a nested query
  5. Model a multi-step workflow as a state machine and find the transition nobody guards
  6. Write a logic bug up in terms of the assumption it breaks, not the request that broke it

Running order (90 min)

TimeWhat happens
0:00-0:09Frame the problemWhat the category looks like when you meet it cold, and why the naive approach fails.
0:09-0:27Teach the methodThe technique itself, on the board or from the lesson. No tools open yet.
0:27-0:50Demonstrate liveSame technique, in the workspace, on your worked example. Narrate every choice.
0:50-1:21Practice setStudents work the challenges. Circulate rather than present.
1:21-1:30Checkpoint and wrapCollect the artefact, name what comes next.

Tools used

  • HTTP request replayer - Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.https://ctfpal.com/?tool=http-request-replayer
  • JWT decoder and signature verifier - Decode a JSON Web Token’s header and payload and verify HS256/HS384/HS512 signatures against a known secret - all locally.https://ctfpal.com/?tool=jwt-decoder
  • Web attack payload catalog - Curated payloads for SQL injection, XSS, SSTI, SSRF, GraphQL, and deserialization, organised by what you are trying to establish.https://ctfpal.com/?tool=payload-catalog
  • Docker image inspector: layers, history and deleted secrets - Open a `docker save` tarball and read what a later layer only pretended to delete - plus the build history, which records every RUN command verbatim.https://ctfpal.com/?tool=docker-image-inspector
  • HTTP security header analyzer - Analyse CSP, HSTS, X-Frame-Options, and CORS headers on a response - and find the gaps in a Content-Security-Policy that make XSS exploitable.https://ctfpal.com/?tool=security-header-analyzer
  • Regex tester with match offsets and capture groups - Test regular expressions live against sample text, with every match’s offset, capture groups, and named groups broken out.https://ctfpal.com/?tool=regex-tester

Reading

  • Hacking APIs: the bugs that live between endpoints - 6 min. Modern web challenges are increasingly a REST or GraphQL API and a token. The four vulnerabilities that dominate API CTF - broken object-level auth, broken function-level auth, mass assignment, and GraphQL introspection - and how to test each one.
  • Thinking like the designer: finding the intended flaw - 5 min. The hardest CTF challenges have no memory-corruption and no injection - just a system whose logic can be bent. Threat modeling from the attacker's chair: trust boundaries, assumptions, and the questions that find a logic bug.

Practice set

Real picoCTF challenges tagged with this module’s techniques, easiest first. Assign the first three in class and the rest as homework.

  1. GET aHEAD - picoCTF 2021, easy
  2. head-dump - picoCTF 2025, easy
  3. IntroToBurp - picoCTF 2024, easy
  4. logon - picoCTF 2019, easy
  5. Old Sessions - picoCTF 2026, easy
  6. Apriti sesamo - picoCTF 2025, medium
  7. byp4ss3d - picoMini by CMU-Africa, medium
  8. Credential Stuffing - picoCTF 2026, medium
  9. Failure Failure - picoCTF 2026, medium
  10. Fool the Lockout - picoCTF 2026, medium
  11. Live Art - picoCTF 2022, hard
  12. secure-email-service - picoCTF 2025, hard

Checkpoint (gradeable)

Against a multi-step workflow, complete it in an order the designer did not intend and state precisely which check assumed the previous step had happened.

Deliberately a produced artefact rather than a quiz question: it is either there or it is not, which makes it fast to mark and hard to bluff. Every tool in ctfpal is deterministic, so two students who did the work correctly hand in the same value.

Where the room gets stuck

Logic bugs are the hardest to teach because there is no payload to memorise. The reliable exercise is to make students write down the intended flow first, in five lines, and then attack their own diagram - the gap between the diagram and the implementation is where every finding comes from.

  • Reporting an IDOR from one account. Without a second principal you have proved that an object exists, not that you were not entitled to it.
  • Assuming the documented API is the API. Older versions, internal hosts and undocumented parameters routinely outlive the docs that describe them.
  • Looking for injection in a logic challenge. If every request is individually valid, the bug is in the order, the quantity, or the state - not in the parsing.
  • Testing GraphQL only through the queries the UI issues. Introspection, aliases and batched operations reach fields, and rate-limit behaviour, that the client never exercises, and that is where the authorisation gaps sit.
  • Assuming a negative quantity, a zero, or an absurdly large one will be rejected because the form will not accept it. The browser's constraint is not the server's, and those are exactly the values at which a workflow's arithmetic stops holding.

If a student wants the subject, not the answer

Chapter-level references, so a student can be pointed at twenty pages rather than at a book. Nothing here is required to complete the module.

  • Hacking APIs, Corey Ball. Chapter 3, Common API Vulnerabilities. The API-specific bug classes named and separated, which stops everything being called 'an IDOR'.
  • Hacking APIs, Corey Ball. Chapter 11, Mass Assignment. The diff-based method for finding assignable fields, which generalises well beyond APIs.
  • Hacking APIs, Corey Ball. Chapter 14, Attacking GraphQL. Introspection, query depth and batching - the three things that make GraphQL its own surface.
  • Real-World Bug Hunting, Peter Yaworski. Chapter 18, Application Logic and Configuration Vulnerabilities. The closest thing to a worked corpus of logic bugs, each with the assumption that failed.
  • Designing Secure Software, Loren Kohnfelder. Chapter 6, Secure Design. Read it from the other side: the design decisions listed here are the ones a logic bug is a failure of.

If you finish early

  • Hand out a challenge from the cross-CTF index in this category - each one has published solutions to compare afterwards.
  • Run the same input through Identify and let the class argue with the ranking. Disagreeing with a confidence score is where the technique actually lands.
  • Ask a student to break their own example - construct an input that defeats the tool, and explain why.

Take this into a room

Markdown files, built here in your browser. They print, they open in anything, and they carry the challenge text - so the session works with no network in the room.