HTB CWPE: API and Modern Web Technology Exploitation

What this domain tests

API and Modern Web Technology Exploitation tests REST, GraphQL, WebSockets, and modern auth patterns. The exam expects you to find undocumented endpoints and abuse object-level and function-level authorization.

Core rules and concepts

• Discover specs: /swagger.json, /openapi.json, /graphql, /api/docs, and JavaScript source maps.
• For REST, test methods (GET, POST, PUT, PATCH, DELETE), content types, version prefixes (/v1 vs /v2), and trailing slashes.
• BOLA is object-level authorization failure; BFLA is function-level. A valid token for user A must not read user B's object or call admin functions.
• GraphQL: try introspection, then field suggestions and error messages. Test mutations and nested object access, not just queries.
• WebSockets need Origin checks, message-level authorization, and replay testing; HTTP auth controls do not automatically apply to messages.
• Try HTTP verb tampering and content-type switching when a method appears blocked.

Worked example

/api/v1/users/me returns your profile. You notice /api/v2/users/1001 in a JavaScript bundle. With your user token, GET /api/v2/users/1001 returns another user's email and role. The reasoning is that v2 introduced a direct object route and the gateway only checks authentication, not ownership. You then test PATCH /api/v2/users/1001 with {'role':'admin'} to determine whether BFLA also exists.

Traps that cost marks

• Treating a 404 as proof an endpoint does not exist; try alternate versions and methods.
• Testing GraphQL only with introspection, which is often disabled in production.
• Forgetting that API keys and JWTs can have different scopes.
• Ignoring rate limits and lockout behavior during brute force.