Exploiting an API endpoint using documentation

Platform: PortSwigger | Category: API testing | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, API testing

Summary

Walkthrough of the PortSwigger Web Security Academy lab Exploiting an API endpoint using documentation (API testing). This lab demonstrates a api testing vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — API testing

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Login as Wiener with the provided credentials - wiener:peter.

Now when we change the email of wiener, the browser sends the folowing PATCH request to /api/user/wiener

If we remove user/wiener & send the request, we get the REST API documentation.

Now we can delete the user carlos by sending a DELETE request to /api/user/carlos.

Now we have deleted carlos's account & thus solved the lab.

Key Takeaways / Lessons

• Understanding API testing detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Exploiting an API endpoint using documentation