Making Security Fun for Developers
Tags: api, security, openapi, owasp
Published: 2022-05-25 19:01:44

## Developers do care about security
Developers want to do the right thing for security. The real challenge is that they do not understand what that “right thing” is.

Developers are naturally curious souls, and tend to operate based on principles and causation of things. They will easily do the “right thing”, when application security issues are presented in a format that is well aligned with how they absorb information.

## OWASP crAPI aims to make security fun
[OWASP crAPI](https://owasp.org/www-project-crapi/) is a vulnerable demo application from the OWASP foundation, that makes learning about API security fun for developers.

crAPI stands for Completely Ridiculous API, and is built on modern API/microservices based architecture. [Corey Ball](https://www.linkedin.com/in/coreyball/), author of [Hacking APIs](https://nostarch.com/sites/default/files/styles/uc_product_full/public/HackingAPI_front.png?itok=Sha90KYS) refers to crAPI extensively in his lab exercises.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tgg2jpbum1osry1sp42y.jpeg)

## Levo gives crAPI a facelift
We at [Levo.ai](https://levo.ai) have made a number of improvements to the original crAPI, leading to a much better learning experience. Below is a summary of these improvements.

### Fast Install & Startup
As part of [quick-start](https://github.com/levoai/demo-apps/blob/main/crAPI/docs/quick-start.md), we offer a single pre-built docker container, that gets you instant access to crAPI on your laptop.

### Full OpenAPI Specifications

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/e0obc4rzzbnwnwodb1po.png)
crAPI now has an embedded API explorer with full [OpenAPI 3.x specifications](https://github.com/levoai/demo-apps/blob/main/crAPI/api-specs/openapi.json), for all its endpoints. You can invoke these APIs directly from this interface and elicit responses.

### Pre-populated user accounts & data
User accounts and related data have been [pre-populated](https://github.com/levoai/demo-apps/blob/main/crAPI/docs/user-asset-info.md) for rapid access to crAPI.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v3e7z4w3xegvcc13t1ln.png)

### User Roles for Privilege Escalation Exercises

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2a0egv2ru1roxetysqkc.png)
CrAPI’s APIs now have clearly defined [roles](https://github.com/levoai/demo-apps/blob/main/crAPI/docs/user-asset-info.md#user-info). This is critical in learning about privilege escalation and abuse.

### HackPad

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qdez7ca9x514n83b8t3i.png)
Embedded within crAPI is a [HackPad](https://github.com/levoai/demo-apps/blob/main/crAPI/docs/hackpad.md) interface, that allows you to interactively hack crAPI’s APIs, and learn more about API vulnerabilities.

### Improved Documentation
The [documentation](https://github.com/levoai/demo-apps/blob/main/crAPI/README.md) has been spruced up for quick access to important information.

## Stay tuned for the hacking APIs series
We will be posting a series of [articles](https://levo.ai/blog/) on hacking crAPI’s APIs. In meantime we encourage you to take crAPI for a spin on your laptop.

If you prefer to try a fully hosted version of crAPI, [signup](https://levo.ai/levo-signup/) for a forever free account, and experience crAPI via Levo SaaS.