CAPIE - Certified API Hacking Expert Course Content

Learn to talk to APIs using curl, covering get, post, put, delete, headers, body data, authentication options, and handling redirects, cookies, and file downloads.

Explore postman, a versatile api testing tool that helps you talk to apis, run collections, set bearer tokens, import swagger, and automate tests, with pre-request scripts, headers, and console debugging.

Explore SoapUI as a practical tool to talk to soap services, import WSDLs, and interact with rest projects alongside Postman. Learn how it handles assertions for soap services.

Learn how Python uses the requests library to interact with APIs, manage sessions and proxies, handle JSON and form data, and implement error handling and rate limits for API testing.

Discover broken object level authorization (bola/idrs) in APIs, its impact from data leakage to account takeover, and testing and mitigation strategies using jwt tokens and centralized access control.

Identify and mitigate broken user authentication in APIs by enforcing rate limiting and captcha, validating and securing JWT tokens, and implementing multifactor authentication and safe authentication practices.

Enforce rate limiting on every API endpoint to prevent denial of service and credential stuffing, and cap requests and input sizes with docker memory limits and clear feedback.

Identify and mitigate broken function level authorization by detecting shadow and ghost properties, improper admin flags, and insecure endpoint access through parameter, url, and method manipulation.

Learn about excessive data exposure: prevent sending card numbers or CVV to the front end by filtering API responses to only required fields and using scheme-based automated validation.

Tackle mass assignment risks in api design by mapping front-end variables to back-end objects and identifying editable properties like account type. Favor whitelisting over blacklisting to block unauthorized edits.

Explore security misconfigurations in API environments, including misconfigured services, software, and file uploads in hybrid cloud setups. Learn risk assessment, SLAs, TLS, and automation with schema-based validation to prevent leaks.

Explore API injections, including SQL, LDAP, and OS command injections, and learn to sanitize inputs from front end and API, validate requests, and apply OpenAPI-based defenses and testing.

Explore improper asset management in APIs, learn how to inventory all production endpoints, retire stale versions, and guard against rogue APIs with gateways, documentation, and security controls.

Master insufficient logging and monitoring in APIs by logging wrong login attempts, brute force attempts, and errors, and ensure monitoring triggers appropriate actions when something goes wrong.

Master broken object level authorization (A1) within OWASP top ten by examining access to all and specific books on the /api/v1/resources/books endpoints, triggering forbidden access with a post request.

Examine broken authentication with a no-captcha login page, showing how bots attempt logins and how rate limiting can prevent credential stuffing.

Identify and fix the lack of rate limiting in the login system to prevent brute-force attacks and bot activity, especially where no captcha exists.

Explore excessive information disclosure in API responses, where a UI reveals sensitive data like credit card numbers and validity dates, while CVV remains hidden, illustrating man-in-the-middle risks.

Learn how broken function level authorization in APIs exposes hidden admin endpoints, version three routing, and how post requests, wrong parameters, and brute force testing reveal access control gaps.

Explore mass assignment by showing how exposing the user type in a post request can change a user to admin, and a response may reveal values attackers can copy.

Explore a security misconfiguration example by inspecting a debug setting left true, enabling remote debugging; always set debug to false.

Identify the security misconfiguration by leaving debug set to true, which could allow remote debugging. Set debug to false to prevent unauthorized access.

Demonstrate a basic SQL injection on a login form and how crafted inputs bypass authentication. Also introduce broader injection types: cross-site scripting, LDAP injections, CSV injections, and JSON injections.

Demonstrates an sql injection on a login form and introduces eight injections, including sql, cross-site scripting, ldap, csv, and json injections.

Recognize the dangers of improper asset management when testing APIs, and learn to inventory systems, track ports and version numbers, and maintain a proper asset repository.

Unmonitored log files invite intruder attacks. Segregate log files, implement active monitoring, and avoid wasting logging budgets by watching for attackers.

Learn how to craft a comprehensive API penetration testing test plan, covering scope, methodology, tools, grey box testing, OWASP guidelines, information gathering, exploitation, reporting, and risk ratings.

Create a concise test report detailing findings, executive summary, methodology, steps to reproduce, prerequisites, CVSS scoring, severity levels, and prioritized recommendations, with test evidence and appendices.

Deliver a concise, structured debrief presentation in PowerPoint that reviews findings, impact, and remediation, includes lessons learned and future assessments, and engages stakeholders from the pen test and security teams.

Explore a cheese inventory api in a practice exam, identify critical exploits across endpoints, including authorization gaps, insecure direct object references, sql injection, and weak jwt, using the api docs.

Explore how APIs work, how to authenticate, and how to test endpoints for vulnerabilities using curl, Postman, Burp Suite, and Swagger/OpenAPI, including SQL injection and content discovery.