← all datasets
from the project README
◆ Vulnerable targets & payloads
OWASP crAPI
Apache-2.0completely ridiculous API — a deliberately vulnerable microservice API covering the OWASP API Security Top 10, for testing API security products.
Summary
completely ridiculous API (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself. crAPI is modern, built on top of a microservices architecture. When time has come to buy your first car, sign up for an account and start your journey. To know more about crAPI, please check crAPI's overview.
- Formats
app- License
- Apache-2.0
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
$ curl -L -o /tmp/crapi.zip https://github.com/OWASP/crAPI/archive/refs/heads/main.zip
-
$ unzip /tmp/crapi.zip && cd crAPI-main/deploy/docker && docker compose pull && docker compose -f docker-compose.yml --compatibility up -d
Listens on localhost by default; the README's LISTEN_IP override exposes it, so leave it unset.
Contents
1,062 files 8.1 MB repository
-
.go426 -
.java97 -
.yaml90 -
(no ext)75 -
.py72 -
.md42 -
.tsx37 -
.ts30
Use it with
Commands are curated, not yet run by us.
nuclei — Scan the target once it is running locally (adjust the port to the one you exposed).
$ nuclei -u http://127.0.0.1:3000
OWASP ZAP — Run ZAP's passive baseline scan against the locally running target.
$ docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000