Damn Vulnerable API (DVAPI) is an intentionally vulnerable API application designed for learning, practicing, and testing API security concepts.

The project provides a realistic development environment where developers and security researchers can explore common API vulnerabilities in a safe and controlled setup.

• Docker
• Make

1. Clone the repo and enter it:

git clone <repo-url> DVAPI
cd DVAPI

2. Start the stack (build images, migrate the database, and load sample data):

make up

That starts everything, sets up the database, and loads sample data.

3. Open the App (UI) and create an account with Register, or log in if you already have one.

Stop everything with:

make down

To wipe database and cache volumes as well:

make clean

make up          # start everything (build if needed), migrate, seed
make down        # stop and remove containers
make ps          # what’s running?
make logs        # follow all logs
make clean       # stop and wipe database/cache data

make dev does the same thing as make up.

make migrate-up       # apply new schema changes
make migrate-down     # undo the last change
make migrate-status   # see migration state

The stack must already be up (make up).

make seed                           # load all default sample data
make seed ARGS="users"              # only users
make seed ARGS="courses enrollments"
make seed-status                    # what’s already loaded?

Default seed sets: users, courses, enrollments, assignments, submissions, announcements.

make rebuild          # rebuild images from scratch
make prune            # remove containers, data volumes, and local images
make backend-shell    # shell inside the backend container
make db-shell         # open a database prompt

Run make help for the full list.

DVAPI intentionally includes vulnerabilities across multiple attack surfaces and protocols to simulate realistic API security challenges.

• REST API
• GraphQL
• SMTP
• Database layer
• Operating system (OS) layer

• OWASP API Security Top 10
• Injection vulnerabilities (across multiple protocols and technologies)
• Authentication and authorization flaws
• Information disclosure
• Input validation failures

Note: Specific vulnerabilities and exploitation paths are intentionally undocumented. Discovering and exploiting them is part of the learning experience.