Hacking APIs

Labs

• Web Service & API Attacks
• OWASP API Security Top 10 - 1
  • OWASP API Security Top 10 - 2

Prerequisite reading

• (Book) Hacking APIs: Breaking Web Application Programming Interfaces
• (Book) Black Hat GraphQL: Attacking Next Generation APIs
• SCORCHED EARTH: HACKING BANKS AND CRYPTOCURRENCY EXCHANGES THROUGH THEIR APIS
• OWASP API Security Top 10: https://owasp.org/www-project-api-security | https://apisecurity.io/encyclopedia/content/owasp-api-security-top-10-cheat-sheet-a4.pdf
• GraphQL Injection

Tools

• https://github.com/arainho/awesome-api-security
• KiteRunner, API content discovery. https://github.com/assetnote/kiterunner
• https://github.com/microsoft/restler-fuzzer
• https://github.com/dsopas/MindAPI
• Decode JSON Web Tokens (Online): https://jwt.io
• JWT - JSON Web Token

Intercepting proxies

These let you view, edit, and replay requests, and are extremely useful for finding vulnerabilities in web, mobile and API applications.

• https://portswigger.net/burp
• https://www.zaproxy.org
• https://mitmproxy.org
• https://www.postman.com (API focused)