Offensive API Exploitation

Set up and practice multiple labs, share Postman files, and configure base URLs and ports to safely explore vulnerable APIs before using live web services.

Master the Postman API testing tool to build collections, parameterize environments, and run automated tests with Newman, while integrating with Burp Suite for offensive API exploitation.

Install Postman on Windows, Linux, or Mac, sign in, and explore API design with requests and collections while configuring settings, themes, certificates, and proxies for testing with Burp Suite.

Explore postman navigation and user interface components, including the sidebar, header, builder, and response panels; learn to create requests, organize with collections, and manage headers, authorization, pre-request scripts, and tests.

Create and save get and post requests in postman, using url parameters, request bodies, and collections. Visualize responses and understand how http verbs govern server updates.

Learn how authentication differs from authorization in Postman, implement basic authentication with base64-encoded credentials, and use the authorization tab to construct authenticated requests against secured APIs.

Master OAuth 2.0 authentication in Postman by registering applications, obtaining a client ID and secret, and using access tokens to call Imgur API endpoints for accounts, images, and blocks.

Master JWT authentication in Postman by adding bearer tokens to request headers and using pre-request scripts to propagate tokens across a collection.

Explore how to simplify api pentesting with swagger files and openapi specifications by importing json or yaml definitions. Test endpoints with the swagger ui to reveal parameters and security issues.

Import Postman JSON or open API JSON into Postman, then use API Matrix to transform API formats and convert open API version 3 to Postman 2.0.

Master Burp Suite's OpenAPI parser to load OpenAPI 2.0 files, transform 3.0 to 2.0, add endpoints to sitemap, and test calls via repeater for API pentesting.

Explore how to intercept postman requests in Burp Suite for API pentesting, configure a proxy, apply basic authentication, fix accept header issues, and repeat requests in Burp Suite's repeater.

Explore RESTful api testing by transforming wadl xml and its schema into a Postman collection, configure endpoints and https, and capture requests with Burp Suite for pentest workflows.

Adopt a bug bounty perspective to locate exposed api documentation and endpoints within bug bounty programs by exploring swagger and json files, then test via postman or burp suite.

Explain broken object level authorization (aka insecure direct object reference) and how manipulated IDs in API requests can reveal data if access controls fail.

Explore broken authentication in api exploitation by examining jwt flaws, none algorithm attacks, token handling, and weaknesses like lack of brute force protection, weak passwords, and tokens in urls.

Explore excessive data exposure in APIs, where backend data returns full objects or sensitive fields that bypass client filtering, risking leakage via direct API calls and sniffing.

Explore how lack of resources and absent rate limiting enables DDoS, brute force attacks, and resource exhaustion through large file uploads, oversized requests, and zip bombs.

Expose how broken function level authorization lets regular users access admin endpoints by guessing URLs or altering methods and parameters, and how to test authorization hierarchies across roles.

Learn how mass assignment in APIs lets attackers add or update sensitive properties by submitting extra fields, exploring whitelist vs blacklist, and ways to detect and prevent privilege escalation.

Explore how API security misconfigurations expose data and allow unauthorized access, from unpatched systems and unprotected files to misconfigured TLS, insecure headers, and unnecessary HTTP verbs.

Explore API injections, including SQL, NoSQL, LDAP, and OS command injection, with malicious payloads; learn detection with scanners and fuzzers and the risks of information disclosure, data loss, and takeover.

Identify how old, non-production API versions and unpatched endpoints expose production data, emphasizing the need for proper asset inventory and retirement plans.

Explore how insufficient logging and monitoring enables API abuse, illustrated by the 7-Eleven Japan password reset flaw that allowed resets to arbitrary emails and compromised 900 accounts.

Explore blind sql injection techniques in api endpoints, using blind boolean and time-based payloads, ascii encoding, and error-based steps to reveal database information.

Learn to assess api endpoints for sql injection vulnerabilities by manipulating user and post inputs, use url encoding and union techniques, and employ sql map with burp suite.

Demonstrate blind sql injection on an api, testing uri and post json payloads with a repeater, crafting quotes and boolean payloads to reveal vulnerable parameters.

Discover how to detect SQL injection and authentication bypass vulnerabilities in API endpoints, demonstrate token bypass techniques to access data, and test using practical payloads and Burp Suite.

Explore command injections on API endpoints, and observe how the back end executes commands via the uptime flag, using pipes and post requests to reveal outputs.

Learn how untrusted input can be executed as a command, enabling attackers to control the command or its environment and escalate privileges, with examples like echo extensions and pipes.

Set up an XXE lab by cloning the repository from a go secure access workshop, compiling the app, and launching it with docker compose up for testing.

Explore XML essentials, including DTD definitions, document type declarations, internal and external entities, and parameter entities, with case-sensitive syntax and practical examples.

Delve into parameter entities in DTDs, including internal and external definitions, their use inside DTDs, and how external DTD references can bypass the WAF to access system files.

Explore xml entities from an attack perspective, focusing on system and external entities that may reveal server file contents, such as /etc/passwd, /etc/shadow, and /proc/self/environ.

Explore basic xxe by crafting atom feed xml payloads to load external entities, test doctype declarations, and attempt access to local files like etc/passwd.

Showcase basic xml external entity exploitation to read local files through xml injection, exposing access to passwd, shadow, and other system files with burp suite.

This lecture explains xxe exfiltration using local dtd, illustrating error-based exfiltration, local dtd initialization, and entity injection to read files via dtd payloads.

Examine data exfiltration using local DTD in a lab, showing how to craft XML payloads, exploit doctype entities, and verify error messages with Burp Suite and XML formatter.

Demonstrates data exfiltration via out-of-band XXE by using a domain-hosted DTD to cause the XML parser to reveal file contents to logs and an FTP server.

Explore out-of-band data exfiltration using FTP protocol with DTD payloads, including how to set up public HTTP and FTP servers and analyze logs with Burp Suite.

Explore internal port scanning with the SSC tool to identify open localhost ports, and use doctypes and XML payloads to enumerate and compare port responsiveness.

Explore blind XXE background concepts and blind access via out of band attacks with burp collaborator. Learn XML payloads with doctype and entity definitions and remote file inclusion.

Explore hands-on blind xxe exploitation using doctype and entity abuse, triggering system calls through burp collaborator to observe remote http requests and test data exfiltration.

Learn to identify XXE vulnerabilities in APIs by manipulating content-type and payloads, testing JSON endpoints with XML inputs, and observing parser responses via Burp Suite and Postman.

Explore xml external entity injection in API by crafting doctype and entity payloads to read files and access remote systems, using Burp Suite for testing and Collaborator for callbacks.

Demonstrates xml external entity injection in an api context, using doctype declarations, entities, and system calls to exfiltrate data via Burp Suite, dtds, and Burp Collaborator.

Explore xml external entity injections in api by crafting doctype and entity payloads to read files or exfiltrate data, using poc techniques across put and post requests.

Explore how xml entity expansion attacks exploit dtd-defined entities to exhaust memory and disrupt web services, covering generic, recursive, and remote entity expansions and the xml bomb concept.

Demonstrate XML generic entity expansion attack using doctype and entity in Burp Suite and Postman, testing for resource exhaustion and confirming the target is not vulnerable.

Demonstrates an XML remote entity expansion attack by chaining remote dtds to trigger system commands and exhaust web service resources through recursive entity expansion.

Examine XML remote entity expansion attacks by demonstrating how remote DTD references can trigger system commands and loop through external entities, causing remote resource consumption.

Master server-side request forgery (ssrf) basics as attackers trigger application-initiated requests to access intranet and third-party systems, examining port scanning, proxy use, and local file reads via APIs.

Explore external service interaction strategies with http, understanding how apps trigger requests to web and mail services, and detect vulnerabilities using burp collaborator to observe http and dns interactions.

Explore external service interactions via dns by manipulating headers and parameters to trigger server-side dns lookups, and identify api vulnerabilities through practical demonstrations.

Analyze cross-site scripting in api contexts, including stored, reflected, and blind vulnerabilities, with scenarios from register and comment endpoints and content-type misconfigurations that expose risks.

Demonstrate stored cross-site scripting by posting a script in a comment and comparing html versus json responses to reveal a persistent xss vulnerability.

Explains reflected xss in api endpoints and demonstrates testing with get users and comments, using url encoding, script payloads, and Postman for request manipulation.

Explores content-type cross-site scripting in api endpoints, highlighting how mismatches between request and response content types in login apis enable xss, and demonstrates testing with Burpsuite and repeater.

Explore how cross-site scripting is reflected in the users API endpoint by enumerating methods and injecting script and image payloads with URL encoding to reveal HTML responses.