# vAPI (roottusk) — practice target

vAPI is a Laravel lab that walks the **OWASP API Security Top 10** one exercise
at a time (api1..api10 + jwt/stickynotes), mounted under the `/vapi` prefix.
Project: https://github.com/roottusk/vapi (Apache-2.0).

It is **not** a `--lab` one-command target because upstream builds the app from
source (no official prebuilt image). Run it from the upstream repo, then point
the swarm at it — recon fingerprints vAPI automatically via
`internal/agent/recon/apiprofile_vapi.go` and hands the exploit/--verify agents
its full surface (BOLA, mass assignment, broken auth, injection, …).

```sh
git clone https://github.com/roottusk/vapi
cd vapi
# optional: set APP_URL=http://localhost:8000 in vapi/.env so links resolve
docker compose up -d           # builds; www on :8000, mysql, phpmyadmin on :8001
until curl -sf http://localhost:8000/vapi/api5/users >/dev/null; do sleep 3; done

pentestswarm scan http://localhost:8000 --scope 127.0.0.1/32,localhost --swarm --verify --follow

docker compose down -v
```

The API lives under `http://localhost:8000/vapi/...` (e.g. `/vapi/api1/user/{id}`
for the flagship BOLA). Scan the root (`http://localhost:8000`) — the recon
profile emits the `/vapi/*` endpoint pack on a fingerprint match.