Hacking REST APIs - A beginner's guide

Explore a hands-on lab setup to practice testing vulnerable rest APIs using a secure store virtual machine, Burp Suite, Firefox, VirtualBox, and an Ubuntu 18.04 desktop VM with Docker.

Identify how an inline sql query using a token from get requests creates sql injection in the profile retrieval code and learn to fix it with prepared statements.

explain why passing sensitive data in get requests is dangerous, exposing credentials in access logs, headers, and browser history, and demonstrate switching to post to protect user data.

Identify how sensitive data leaks in API responses occur, exposing passwords and tokens; demonstrate examples with Burp Suite, revealing clear-text password storage and insecure data handling.

Explore how a vulnerable api endpoint processes user-supplied xml via a put request and lacks checks for external entities. This xxe vulnerability enables retrieval of the etsy password file.

Explore how lack of rate limiting in rest APIs enables brute force and denial-of-service attacks. Suggest implementing rate limiting, account lockouts after failed attempts, or captchas to prevent these attacks.

Set up fuzzapi with docker, launch zappy, and run automated rest api scanning to reveal vulnerabilities across high, low, and informational categories, including version disclosure and insecure direct object references.