AltoroJ REST API

{
  "service_type": "platform",
  "base_url": "https://testfire.net:altoroj",
  "auth_method": "none",
  "auth_config": {},
  "endpoints": [],
  "pricing_model": {"type": "free", "details": {"notes": "AltoroJ is a deliberately vulnerable application maintained by IBM for security education and testing."}},
  "rate_limits": {},
  "capabilities": [
    "Deliberately vulnerable online banking demo application",
    "REST API for banking operations (accounts, transfers, login)",
    "Security testing and training target",
    "Supports common web vulnerabilities (SQL injection, XSS, CSRF)",
    "Used for IBM AppScan and other security tool demonstrations"
  ],
  "raw_analysis": "AltoroJ is a Java-based web application created and maintained by IBM as a deliberately vulnerable online banking application. Its primary purpose is educational: to serve as a target for security testing, training, and demonstrations of IBM Security AppScan (now HCL AppScan) and similar security tools. The provided URL (https://testfire.net:altoroj) appears malformed; the actual demo is commonly hosted at https://demo.testfire.net. The service is not a production platform for building integrations; it is a sandbox with known vulnerabilities. The \"REST API\" categorization likely refers to HTTP endpoints used by the web UI (e.g., /login, /doLogin, /transfer, /api/...), but no formal, documented public REST API with authentication exists. Authentication is session-based (cookies) with intentionally weak credentials like admin/admin. Rate limits are not enforced, as the goal is to allow unrestricted testing. Pricing is free; it is an open-source project (Apache 2.0) available on GitHub (github.com/IBM/AltoroJ). Maturity: stable but old (circa 2006-2017), with community forks. Integrations: primarily security scanners, CI/CD pipelines for security validation, and educational exercises. Not recommended for production or as a reliable API provider."
}

0/3 tests passed

{
  "overall": 22,
  "dimensions": {
    "token_efficiency": 8.0,
    "first_try_success": 5.0,
    "response_parseability": 5.0,
    "error_clarity": 7.0,
    "doc_quality": 5.0,
    "auth_simplicity": 7.0,
    "latency": 2.0,
    "consistency": 2.0
  },
  "pricing_normalized": {
    "model": "free",
    "tier": "free",
    "notes": "Open-source, IBM-maintained deliberately vulnerable banking app for security education."
  },
  "issues": [
    "All three platform check requests failed with 'Invalid port: altoroj' — the platform name appears malformed in the URL scheme, suggesting no live/addressable endpoint was resolved.",
    "No working status_code, robots.txt, llms.txt, or security headers were returned, meaning no measurable uptime or latency could be verified.",
    "Latency measurements (27ms, 2ms, 1ms) are meaningless because requests never reached the target — they timed out at URL parsing.",
    "Deliberately vulnerable by design: recommending to end users carries inherent risk if mistaken for a production banking API."
  ],
  "recommendations": [
    "Clarify to users that AltoroJ is a security-testing/demo target, not a real banking platform — never for production or real data.",
    "Fix the integration/URL scheme so checks can resolve a real hostname and port; current name 'altoroj' is being parsed as a port.",
    "Provide a public status page or stable endpoint (e.g., GitHub repo or hosted demo URL) to enable uptime and latency verification.",
    "Document supported vulnerability categories and intended tooling (AppScan demos) up front to set correct agent expectations.",
    "Publish an llms.txt or structured endpoint so agents can introspect capabilities programmatically."
  ]
}