CAPIE — Firewall Bypass & Lab Workflow

Extracted from CAPIE - slides-Master - 002.pptx. Only the substantive sections — the OWASP testing lab slides (7.4/7.5, 8.4/8.5) and firewall-install slides are placeholder text in this deck; those get covered in the course lessons + your Google Doc study guide.

API firewall bypass techniques (6.3)

Slides 177-187. The deck’s real content here.

1. Input validation evasion

• What: circumvent input filters/validation
• How: encoding techniques to slip past filters (URL encoding, double encoding, unicode, case variation)
• Mitigation: strict input validation + decode inputs before validating

2. HTTP verb tampering

• What: exploit overlooked/unrestricted HTTP methods
• How: use PUT or DELETE where only GET/POST was protected. Some firewalls/WAFs only inspect certain verbs — switch verb and the request passes unfiltered
• Mitigation: restrict + filter HTTP methods rigorously (deny by default)
• Related: same bug class as API5 (Broken Function Level Authorization)

3. Header manipulation

• What: alter/add HTTP headers to mislead the firewall
• How: unexpected headers, uncommon header values, X-Forwarded-For spoofing, X-Original-URL overrides
• Mitigation: validate + normalize headers

4. Advanced bypass

• Uncommon protocols / subprotocols
• Request smuggling / splitting (CL.TE, TE.CL desync)
• Both are advanced — normalization mismatch between firewall and backend

Ethical framing (slides 177, 185-186)

• Explicit authorization before testing
• Constructive objective: find + fix, not exploit
• Continuous learning; engage in ethical hacking to identify and remediate

Lab workflow (7.x — Postman track)

7.1 Recon

• Port scan the target to find which port the API listens on (deck notes: port often known from source)
• Gobuster — directory brute force to find API documentation when not public
  • Deck example: found an apidocs folder → Swagger docs exposed
  • This is API9 (Improper Inventory Management) in the wild: undocumented/forgotten endpoints

7.2 Import docs into Postman

1. From Swagger UI, click the docs link → export/download the OpenAPI JSON
2. Postman → Import → drag & drop the .json (creates a collection)
3. Rename collection (Ctrl+E)
4. Set the {{baseUrl}} collection variable — requests won’t hit the right host otherwise
5. Save — un-saved variable changes don’t apply

7.3 Playing with functionality

• Select request → set body type to raw
• Fill in details → Send
• Deck example: successfully registered a user — first proving normal API behavior before attacking

7.4/7.5 Testing OWASP 2019 / 2023

Placeholder slides in this deck — covered in course lessons / your Google Doc.

7.6 Reporting & debriefing

Placeholder slides in this deck. See the pentest documentation section (5.x):

Report structure (from 5.x):

1. Test plan        — scope, approach, tools
2. Findings         — each vulnerability with evidence
3. Methodology      — detailed testing approach, tools, scope
4. Recommendations  — remediation per finding
5. Appendices       — logs, references, supplementary findings

• Grey-box option: source-code-assisted pentesting (faster, deeper)
• Follow the OWASP Web Security Testing Guide (WSTG) for API testing guidelines
• Debrief participants: pentest team, security team, dev team, stakeholders

Section 8 (Swagger track)

Same flow as 7.x but driven through Swagger UI rather than Postman import. Slides are placeholder in this deck.

Gap: OWASP Tactics content

The 2019/2023 OWASP testing walkthroughs are not in this slide deck. Sources for that content:

1. Course lesson videos (thexssrat.podia.com course)
2. The Google Doc study guide (1owwPF7OKVe3gk0L2iuoJ9uAH-YWXEBBoyfVC04pu-A4)
3. Hands-on labs (practice exam machines, section 8/9 of the course)

See [[api-hacking/index]] for the OWASP API Top 10 2023 reference table.

Related

• [[api-hacking/index]]
• [[api-hacking/capie-slides/index]]