# API9:2023 Improper Inventory Management

It's nothing new, but I liked the idea of ​​this lab during study Api Penetration Testing Cource from Api University Platform,  , so I will try to explain it step by step in a simple way and i will 

* Vulnerability in OWASP API  : [https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management](https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/)
* API University Course : <https://university.apisec.ai/products/api-penetration-testing>
* Vulnerable Application : you can use it online <http://crapi.apisec.ai/>  or Download it local <https://github.com/OWASP/crAPI>

## API9:2023 Improper Inventory Management  <a href="#api92023-improper-inventory-management" id="api92023-improper-inventory-management"></a>

* it's a Vulnerability found when application still using API out of date/old versions of APIs. it happen when you upgrade from version 3 to version 4 but leave the old version&#x20;
* &#x20; attacker `discover unsupported` and non-production `versions` of an API  during Reconnaissance  ( all of the APIs that are running, all the endpoints, versions, older versions, who's accessing them )

## **Common endpoints you can find During Recon  :**&#x20;

* like our API has update to `Version 3` and some end points still use `Version 2` like :
  * api.target.com/v3
  * /api/`v2`/accounts
  * /api/`v3`/accounts
  * /`v2`/accounts
* API versioning could also be maintained as a header:
  * *Accept: `version=2.0`*
  * *Accept `API-version=3`*
* `Non-production versions` of an API include any version of the API that wasn’t meant for end-user consumption مش متخصص للاستخدام للمستخدم العادي (نسخه تجريبيه)
  * api.test.target.com
  * api.uat.target.com
  * beta.api.com
  * /api/private
  * /api/partner
  * /api/test

### Scenario ( Use Old Version of Api to Brute Force OTP Code )

1. fuzzing requests in our Postman collection to sort version we have&#x20;

   <figure><img src="/files/r7cBVFUXkmee9pPM0nkt" alt="" width="151"><figcaption></figcaption></figure>
2. configure a test using the Collection Editor
   1. select Collection and choose edit
   2. add this script to know which request has been successfully received   :  &#x20;
      1. `pm.test("Status code is 200", function () { pm.response.to.have.status(200); })`
   3. choose run collection option ⇒ remove requests that `doesn’t have version number`
   4. remove the token to Run an unauthenticated baseline scan of the crAPI collection

<figure><img src="/files/lLtHjssaOEazRo9ZYDsb" alt="" width="563"><figcaption></figcaption></figure>

3. when we make a test with non authentication we get failed in all requests&#x20;

<figure><img src="/files/06SulU9aD16hCpR3XKy3" alt="" width="563"><figcaption></figcaption></figure>

4. create a new environment
   1. `create a variable give it value v1` in initial value and current value&#x20;

      <figure><img src="/files/4fkCFQWpkixhUUdJRzDC" alt=""><figcaption></figcaption></figure>
5. `"Find and Replace"` all requests with `v2` and replace the all to our variable `{{ver}}` ( v1 )

   1. to turn the collection's current versions into a variable
   2. put variable name between`{{ }}` like `{{ver}}` and choose select all to replace it in all requests&#x20;

   <figure><img src="/files/7pONKVUcMOqrYGZROLmY" alt="" width="375"><figcaption></figcaption></figure>
6. after run i found that the v3 get error 404

<figure><img src="/files/Z6cKRBW7YQZvmN8zABDk" alt="" width="563"><figcaption></figcaption></figure>

7. let’s change the current value to `V2` and run again `OTP request` with replace version to 1 get ⇒ internal server error `500`&#x20;

<div align="center"><figure><img src="/files/6Qh2ua3noKk9jfr5rxze" alt="" width="563"><figcaption></figcaption></figure></div>

8. let’s try 2 times by give the real version with 2 request ⇒ first with v2 and second with v3&#x20;

<figure><img src="/files/BtMDst0TLvCZoQfqSLdX" alt="" width="563"><figcaption><p>first one with v2 </p></figcaption></figure>

<figure><img src="/files/8MvDgWE13wzxw7kpzAjz" alt="" width="563"><figcaption><p>second with v3 </p></figcaption></figure>

9. this is the worst thing because we can use `Unsupported Version` ⇒ we get success
10. when we try to many time to enter `OTP in v3` account locked then we can’t do `brute force`&#x20;

    <figure><img src="/files/ScEHfFAj5QEwKxCsDs1m" alt="" width="563"><figcaption></figcaption></figure>
11. but in `V2 Brute force is available` and account didn’t lock ⇒ this is the vulnerability
12. let’s enable the burp proxy from postman by ⇒ by enter setting then ⇒ add custom proxy and put same ip and port for burp
13. grep “`Invalid`” word because the correct OTP give same response 500 but different error&#x20;

    <figure><img src="/files/ooApiB5YVIu34VhlENjp" alt="" width="563"><figcaption></figcaption></figure>
14. let’s check our mail of CRAPI platform\
    &#x20;

    <figure><img src="/files/WO8KlTvykuepQJWinpi6" alt="" width="563"><figcaption></figcaption></figure>
15. it’s the same and here we success let’s try it with Wfuzz tool to make a brute Force Then send Post request with the new OTP & new Password :&#x20;
    1. `wfuzz -d '{"[k](mailto:email%22:%22hapihacker@email.com)ero@kero.com", "otp":"FUZZ","password":"NewPassword1"}' -H 'Content-Type: application/json' -z file,/usr/share/wordlists/SecLists-master/Fuzzing/4-digits-0000-9999.txt -u [http://crapi.apisec.ai/identity/api/auth/v2/check-otp](http://crapi.apisec.ai/identity/api/auth/v2/check-otp) --hc 500` &#x20;

       <figure><img src="/files/N44Qkv0kCKBbOlzgGkMH" alt="" width="563"><figcaption></figcaption></figure>
16. here we Success in login&#x20;

<figure><img src="/files/dKPyo28TxGxdP17cN9he" alt="" width="375"><figcaption></figcaption></figure>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://kero0x1.gitbook.io/general/web-vulnerabilities/api9-2023-improper-inventory-management.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.