Api hacking course

Lesson 1 • API Documentation and Specifications

Teaches reading OpenAPI, Swagger, WSDL, and GraphQL schemas to understand intended API behaviour. Spec analysis reveals undocumented endpoints and parameter mismatches.

Lesson 2 • How APIs Work

Covers REST, SOAP, GraphQL, and gRPC architectures and their request-response cycles. Establishes the technical baseline needed for all subsequent hacking techniques.

Lesson 3 • Mapping the API Attack Surface

Identifies exposed endpoints, data flows, and trust boundaries that constitute the attack surface. Provides a structured mental model for prioritising test targets.

Lesson 1 • Systematic Vulnerability Testing

Executes tests against each OWASP API Top 10 category in a structured sequence. Systematic coverage ensures no vulnerability class is overlooked during an engagement.

Lesson 2 • Scoping and Pre-Engagement Planning

Defines test scope, rules of engagement, and success criteria before any technical activity begins. Proper scoping prevents legal issues and aligns testing with client objectives.

Lesson 3 • Toolchain Setup and Configuration

Configures Burp Suite, Postman, and specialised API testing tools for an efficient testing workflow. A well-configured toolchain reduces manual effort and improves test repeatability.

Lesson 4 • Evidence Collection and Documentation

Captures reproducible proof-of-concept evidence for each finding during active testing. Quality evidence directly determines the credibility and actionability of the final report.

Lesson 1 • Active Endpoint Enumeration

Applies wordlist-based fuzzing, path brute-forcing, and crawling to discover hidden endpoints. Active enumeration complements passive recon by uncovering non-public routes.

Lesson 2 • API Fingerprinting and Technology ID

Identifies backend frameworks, API gateways, and server technologies from response headers and behaviour. Fingerprinting informs which vulnerability classes are most likely applicable.

Lesson 3 • Passive API Reconnaissance

Uses OSINT sources, search engines, and public repositories to find exposed APIs without direct interaction. Passive recon avoids detection while building a target profile.

Lesson 1 • Broken Authentication Attacks

Targets weak credential policies, token reuse, and flawed login flows to bypass authentication. Covers brute force, credential stuffing, and token theft scenarios.

Lesson 2 • Broken Function Level Authorisation

Accesses admin and privileged functions by manipulating roles, HTTP methods, or endpoint paths. BFLA exploits missing server-side enforcement of function-level access controls.

Lesson 3 • Broken Object Level Authorisation

Demonstrates BOLA/IDOR attacks by manipulating object identifiers to access unauthorised resources. BOLA is the top-ranked API vulnerability and appears in nearly every real-world assessment.

Lesson 4 • JWT Attacks and Token Manipulation

Exploits JWT implementation flaws including algorithm confusion, weak secrets, and claim tampering. JWT vulnerabilities often grant full account takeover or privilege escalation.

Lesson 1 • XML and SSRF via API Inputs

Exploits XML parsers with XXE payloads and triggers SSRF through URL-accepting API parameters. Both vulnerabilities can expose internal infrastructure from a single API call.

Lesson 2 • Command and Code Injection

Exploits APIs that pass user input to OS commands, template engines, or eval functions. These flaws frequently lead to remote code execution on the API server.

Lesson 3 • SQL Injection via API Parameters

Injects SQL payloads through API query parameters, headers, and JSON body fields. API-delivered SQLi bypasses WAFs tuned for browser-based traffic patterns.

Lesson 1 • Excessive Data Exposure

Identifies APIs returning more data than the client needs, exposing sensitive fields filtered only in the UI. Excessive exposure is exploited by directly consuming raw API responses.

Lesson 2 • Mass Assignment Vulnerabilities

Exploits APIs that bind request body fields directly to data models, allowing unauthorized property modification. Mass assignment can escalate privileges or alter protected account attributes.

Lesson 3 • Business Logic Abuse Patterns

Manipulates API workflows to bypass intended business rules such as pricing, limits, and state machines. Logic flaws require understanding the application's intended behavior to exploit.

Lesson 1 • API Abuse and Scraping

Automates API calls to harvest data, enumerate users, or abuse free-tier resources at scale. Scraping and enumeration attacks exploit missing or weak anti-automation controls.

Lesson 2 • GraphQL-Specific Abuse

Exploits GraphQL-specific features including introspection, query batching, and field duplication for abuse. GraphQL's flexibility creates unique attack vectors not present in REST APIs.

Lesson 3 • Resource Exhaustion Attacks

Sends crafted requests that consume excessive CPU, memory, or database resources on the API server. Resource exhaustion can degrade or crash services without exploiting code vulnerabilities.

Lesson 1 • Vulnerability Chaining for Impact

Combines low-severity findings into high-impact exploit chains that demonstrate real business risk. Chaining transforms individually minor flaws into account takeover or data breach scenarios.

Lesson 2 • Automated Exploitation and Scripting

Builds custom scripts and automation to exploit APIs at scale and reproduce complex attack chains. Automation skills differentiate advanced testers from those relying solely on GUI tools.

Lesson 3 • API Gateway and Middleware Attacks

Exploits misconfigurations in API gateways, reverse proxies, and middleware that create security gaps. Gateway-level flaws can bypass controls applied uniformly across all backend services.

Lesson 4 • Webhook and Callback Exploitation

Abuses webhook registration, callback URLs, and event-driven API features to trigger SSRF or data exfiltration. Webhooks are often overlooked attack vectors in API security assessments.