# Tiredful API — practice target

Tiredful is an intentionally-vulnerable REST API (Django REST Framework) built
to teach API flaws: Insecure Direct Object Reference (BOLA/IDOR), information
disclosure, broken access control, request throttling, SQL injection (SQLite),
XSS, and JWT-based scenarios. API routes live under `/api/v1/`. Project:
https://github.com/payatu/Tiredful-API (MIT).

It **is** a one-command `--lab` target: the `insecureapps/tiredful-api` image is
a self-contained single container (SQLite-backed, gunicorn on :8000 — no linked
database), so the swarm can spin it up and tear it down for you:

```sh
pentestswarm scan --lab --lab-target tiredful --verify --follow
```

Prefer to run it yourself (e.g. to pin a tag or build from source):

```sh
docker run -d --name tiredful -p 127.0.0.1:8000:8000 insecureapps/tiredful-api:latest
until curl -sf http://localhost:8000/ >/dev/null; do sleep 3; done

pentestswarm scan http://localhost:8000 --scope 127.0.0.1/32,localhost --swarm --verify --follow

docker rm -f tiredful
```

The app's web UI (at `/`) documents each challenge and its `/api/v1/...`
endpoint; the headline flaw is IDOR on resource-by-id routes. Obtain a token
via the app's token flow, then replay other users' resource ids.