Hacking REST APIs - A beginner's guide

Explore a hands-on lab setup to practice testing vulnerable rest APIs using a secure store virtual machine, Burp Suite, Firefox, VirtualBox, and an Ubuntu 18.04 desktop VM with Docker.

Explore the fundamentals of rest APIs, where rest stands for representational state transfer, and is an architectural style, not a protocol, often using http.

Understand how resources and verbs trigger actions on them with post, get, and put. Learn media types such as json or xml and status codes in a Rest API.

Learn why a true rest api is stateless, where each request contains all necessary information, including authentication tokens and product details with product ids, without any server state.

Explore the foundation of rest APIs and the security testing workflow, including tokens, documentation, sample requests, headers, and fuzzing to uncover vulnerabilities.

Identify traditional web vulnerabilities in REST using similar web development techniques, including SQL injection, command injection, and XSS, plus insecure direct object references and get requests that send sensitive data.

Demonstrates sql injection on a rest api by testing the token parameter, confirming vulnerability with payloads, and enumerating columns and tables to reveal user credentials.

Identify how an inline sql query using a token from get requests creates sql injection in the profile retrieval code and learn to fix it with prepared statements.

explain why passing sensitive data in get requests is dangerous, exposing credentials in access logs, headers, and browser history, and demonstrate switching to post to protect user data.

Learn how insecure direct object references and weak token generation enable attackers to bypass authorization, reuse md5-derived tokens from usernames, and exploit missing access controls.

Identify how sensitive data leaks in API responses occur, exposing passwords and tokens; demonstrate examples with Burp Suite, revealing clear-text password storage and insecure data handling.

Explore api documentation to identify endpoints, such as register via post, login with token, and token-protected profile fetch, plus put and delete xml data to test for XXY vulnerabilities.

Explore how to test for XML external entity injection (XXE) in REST APIs, showing how external entities can be used to extract sensitive server data.

Explore how a vulnerable api endpoint processes user-supplied xml via a put request and lacks checks for external entities. This xxe vulnerability enables retrieval of the etsy password file.

Explore broken authentication in rest APIs through SQL injection on the login endpoint, showing how attackers obtain tokens and email IDs, and how prepared statements fix the vulnerability.

Explore how lack of rate limiting in rest APIs enables brute force and denial-of-service attacks. Suggest implementing rate limiting, account lockouts after failed attempts, or captchas to prevent these attacks.

Learn practical pentesting tips for rest APIs, including testing different request methods on profile endpoints and swapping json to xml, with guidance from the OWASP API Security Project.

Explore automated tools for rest api vulnerability scanning, compare commercial options like burp scanner with freely available tools, and learn why manual testing remains essential.

Set up fuzzapi with docker, launch zappy, and run automated rest api scanning to reveal vulnerabilities across high, low, and informational categories, including version disclosure and insecure direct object references.

Set up Astra with Docker and MongoDB, run API scans, and review reports detailing missing headers like XSS protection, X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security, plus server version disclosure.

Reach the end of the course and reflect on what you learned about rest api security. Share feedback and recommendations with friends to help improve future courses.