Jumpstart Security & Penetration Testing APIs
summary
Provides a hands-on checklist and live techniques for API penetration testing, demonstrating real failures like exposed GitHub tokens, public Postman collections leaking long‑lived credentials, and a trial‑expiry bypass that still allows backend calls. Shows how to fuzz endpoints and headers to trigger SQL injections or unexpected XML/JSON responses, test verb tampering that can delete resources, decode JWTs with jwt.io decoder, run automated fuzzing via Burp Suite intruder, and practice on Damn Vulnerable Web Services.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 0:17Importance of API
- 1:48Objectives
- 2:11Attack Surface
- 3:53Authentication Authorization
- 8:45Endpoints
- 10:32Parameters
- 12:51Outdated APIs
- 14:06Learning Resources
related talks
26mOffensive API Penetration Testing
08mAutomated Security Testing for JS Apps
27mHow to Start Security Testing Without Fear
53mHacking And Defending APIs: Red And Blue Make Purple
25mHack-Proof Your API: Exclusive Attack Simulator Deep Dive 🛡️
35mHow to Break API's
17mAn API Security Testing Blueprint: Because Unit Tests Just Aren't Enough.
39mThe API Assessment Primer