APIGOAT is a deliberately vulnerable RESTful API designed for penetration testing training, exploit demonstrations, and secure coding education. Built with Node.js, Express.js, and MongoDB, packaged in a single Docker container for zero-configuration deployment.

Key Features:

• 🎯 Complete OWASP API Top 10 (2023) coverage
• 🐳 Single Docker image (Node.js 18 + MongoDB 7.0 + 10 APIs + Web UI)
• 🚀 One-command deployment from Docker Hub
• 🔒 Isolated environment safe for exploitation
• 📚 Interactive documentation and exploit examples
• 💻 Cross-platform (Windows, Linux, macOS)

Originally initiated under OWASP Bursa Technical University Student Chapter
Developed and maintained by Yusuf Talha Arabacı

docker run -d --name apigoat -p 8000-8010:8000-8010 -p 27017:27017 yusufarbc/apigoat:latest

Access at http://localhost:8000 (ready in 10-15 seconds)

# Clone repository
git clone https://github.com/yusufarbc/apigoat.git
cd apigoat

# Windows
.\start.ps1

# Linux/macOS
docker build -t apigoat:all .
docker run -d --name apigoat-all -p 8000-8010:8000-8010 -p 27017:27017 apigoat:all

docker logs -f apigoat           # View logs
docker stop apigoat              # Stop container
docker rm apigoat                # Remove container
docker restart apigoat           # Restart

┌──────────────────────────────────────────────────────────────┐
│              Single Docker Container (~1.2GB)                │
│  ┌────────────────────────────────────────────────────────┐  │
│  │  Node.js 18 (Ubuntu 22.04)                             │  │
│  │  ├─ MongoDB 7.0 (embedded, port 27017)                 │  │
│  │  ├─ Web UI (port 8000)                                 │  │
│  │  └─ API1-10 (ports 8001-8010)                          │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

Tech Stack:

• Runtime: Node.js 18 | Framework: Express.js 4.19.2
• Database: MongoDB 7.0 | ODM: Mongoose 8.4.5
• Auth: JWT 9.0.2 + bcrypt 5.1.1

Recommended Path:

1. API1 - BOLA (Start Here)

   # Create two users
   curl -X POST http://localhost:8001/signup \
     -H "Content-Type: application/json" \
     -d '{"name":"Alice","email":"[email protected]","password":"secret"}'
   
   # Access other users' files with Alice's token
   curl http://localhost:8001/files/2 \
     -H "Content-Type: application/json" \
     -d '{"token":"<alice_token>"}'

2. API7 - SSRF

   # Access internal services
   curl "http://localhost:8007/weather?location=http://mongodb:27017"
   
   # Attempt cloud metadata
   curl "http://localhost:8007/weather?location=http://169.254.169.254/latest/meta-data/"

Security Tools:

• Burp Suite - Intercept and modify requests
• OWASP ZAP - Automated scanning
• Postman - API testing
• curl/httpie - Command-line testing

Secure Coding Checklist:

• ✅ Validate ownership before resource access (fix BOLA)
• ✅ Implement proper authentication middleware (fix API5)
• ✅ Apply rate limiting and pagination (fix API4)
• ✅ Filter sensitive properties from responses (fix API3)
• ✅ Validate and sanitize external API responses (fix API10)
• ✅ Restrict CORS to known origins (fix API8)

Code Review Exercise:

# Study vulnerable patterns
1. API5/check-auth.js - Bypassed authentication
2. API1/routes.js - Missing ownership check
3. API4/routes.js - No pagination limits
4. API7/routes.js - SSRF via user input

Resources:

• 📖 OWASP API Security Top 10 2023
• 🔐 JWT Security Best Practices
• 📚 REST Security Cheat Sheet

Safe Usage:

# ✅ Good: Local isolated environment
docker run -d --name apigoat -p 8000-8010:8000-8010 -p 27017:27017 yusufarbc/apigoat

# ❌ Bad: Exposing to public network
docker run -d --name apigoat -p 0.0.0.0:8000:8000 ... # DON'T!

# Connect from host
mongosh mongodb://localhost:27017/apigoat

# Connect from inside container
docker exec -it apigoat mongosh --eval "db.getMongo().getDBNames()"

# Backup
docker exec apigoat mongodump --out /tmp/backup

# Check port usage
netstat -ano | findstr :8000  # Windows
lsof -i :8000                 # Linux/Mac

# Use different ports
docker run -d -p 9000-9010:8000-8010 ... yusufarbc/apigoat

# View logs
docker logs apigoat

# Restart
docker restart apigoat

# Full cleanup
docker stop apigoat && docker rm apigoat
docker image prune -a

# Enter container
docker exec -it apigoat /bin/bash

# Check services
tail -f /var/log/api1.log
tail -f /var/log/mongodb.log
ps aux | grep node

accountSchema.index({ email: 1 }, { unique: true });
filesSchema.index({ number: 1 });
bookSchema.index({ name: 1, author: 1 });

const compression = require('compression');
app.use(compression());

Contributions welcome! Ways to help:

• 🐛 Report bugs via GitHub Issues
• 💡 Suggest new vulnerability patterns
• 📝 Improve documentation
• 🔒 Add OWASP coverage examples
• 🧪 Write security test cases

Quick Development Setup:

git clone https://github.com/YOUR_USERNAME/apigoat.git
cd apigoat
git checkout -b feature/your-feature

# Test changes
docker build -t apigoat:test .
docker run -d --name apigoat-test -p 8000-8010:8000-8010 apigoat:test

# Submit PR
git commit -m "Add: Description"
git push origin feature/your-feature

PR Checklist:

• Code builds without errors
• Container starts successfully
• Changes documented with comments
• README updated (if needed)
• Vulnerabilities remain intact (no accidental fixes!)

Licensed under GNU General Public License v3.0 (GPL-3.0)

• ✅ Use, modify, and distribute freely
• ✅ Must disclose source code
• ✅ Same license for derivatives
• ✅ State changes made

See LICENSE for full details.

• OWASP Foundation - API Security Top 10 2023 framework
• OWASP Bursa Technical University - Project initiation support
• Open Source Community - Tools and libraries

• 🐛 GitHub Issues
• 💬 GitHub Discussions
• 📧 Email via GitHub profile
• 🐳 Docker Hub