Breaking APIs: An Offensive API Pentesting Course

Explore what API pentesting is and why it matters, and review common vulnerabilities such as broken object level authorization, broken authentication, injection attacks, excessive data exposure, and Ssrf.

Install updates on kali, install docker compose, clone cr API, vapi, and capital API repos, and run docker compose up to access the labs’ UIs at localhost:8000 and localhost:4100.

Configure your browser to route traffic through Burp Suite by installing the proxy extension, setting Burp on port 8080, and importing the Burp CA certificate for secure API testing.

Download and install Postman on a Kali Linux system by downloading the Linux 64-bit tar, extracting it, and launching the binary; then create a Postman account for next configuration lecture.

Learn how to set up Postman with a Burp Suite proxy and send HTTP requests. Explore managing parameters, headers, authorization (bearer, JWT), viewing responses, and organizing requests into collections.

Introduce active and passive recon for API pen testing, detailing methods and tools such as Google Docs, Shodan, GitHub talking, fuf, kite runner, wrestler, and Postman.

Fuzz API endpoints and sensitive data using fuf with the API endpoints dot txt wordlist, and compare with Kite Runner for advanced API discovery.

Discover passive recon techniques for API pentesting using public docs, search queries, and exposure of keys; explore tools like Amass, Shodan, Wayback, and GitHub for API endpoints and documentation.

Learn to locate api endpoints using white-box or black-box approaches, use osint and fuzzing to discover docs, import openapi.json or swagger.json into Postman, and build a custom endpoint collection.

Identify broken object level authorization (bola/idor) by tampering user identifiers in API calls, clarifying authentication vs authorization, and preventing access to other users’ data with policy-driven, session-based checks.

Demonstrates broken object level authorization by swapping vehicle IDs to access other users' data, illustrating excessive data exposure in a practical lab with kr api, Burp Suite, and Postman.

Discover how broken object level authorization is exploited to delete comments and articles via API endpoints, using signup, login, JWT tokens, and current user data in a practical walkthrough.

Explore broken user authentication vulnerabilities, including weak credentials, token and JWT flaws, insecure data in URLs, brute force and credential stuffing risks, with prevention through authentication practices and rate limiting.

Explore how broken user authentication enables arbitrary access by brute-forcing credentials, extracting a JWT token, and accessing another user's profile via API endpoints in a capital API lab scenario.

Explore broken authentication on a web API by performing credential stuffing attacks to uncover valid credentials and obtain access tokens through the login endpoint.

discover how json web tokens secure authentication and authorization, uncover their header, payload, and signature structure, and explore common jwt vulnerabilities, exploits, and notable cve ids using a jwt tool.

Explore practical JWT token attacks by tampering and injecting claims with a JWT tool, revealing vulnerabilities like algorithm manipulation, blank signatures, and admin access via Burp Suite.

Explore broken functional level authorization, or buffalo, a vulnerability where unauthorized users access admin endpoints and sensitive functions via predictable REST APIs (and GraphQL), with testing and prevention strategies.

Explore broken function level authorization by accessing admin api endpoints to change video names and delete videos, illustrating privilege escalation in buffalo vulnerability scenarios.

Demonstrate broken function level authorization in a Vapi lab by creating a user and accessing admin and user endpoints to reveal a flag.

Understand server side request forgery (ssrf) as a vulnerability that forces a server to access internal or external services, and prevent it by validating inputs and restricting outbound requests.

Explore practical server side request forgery (ssrf) on the ci api by intercepting and forwarding requests, testing with a google.com domain, and identify broken object level authorization via jwt-protected reports.

Practice server side request forgery vulnerability in an API by sending requests to various domains through a test endpoint, and observe the responses.