API mayhem

She stood on the bridge and frowned: To bridge over something had led to building bridges. But was it a bridge too far? Was the gap not too wide?” She turned to look at the other side, “I’ll cross that bridge when I come to it. No need burning it now.”

An API is a technology that enables communication between different applications. API Penetration Testing is a type of security testing performed on application programming interfaces (APIs) to assess the strength of the security controls in place.

---

Test lab

• API tools

Preparation

• Reconnaissance
• Enumeration

Notes on techniques

• Introduction
• Challenges
• Rate limit tests
• Collect requests information
• Fuzz deep and wide
• Evasive techniques
• Attack authentication
• Exploit authorisation
• Inject with mass assignment
• Try traditional injections

CTFs and challenges

• Introduction
• RootMe: GraphQL Introspection

---