Test lab

API tools

Preparation

Reconnaissance
Enumeration

Notes on techniques

Introduction
- What?
- Why?
- How?
Challenges
Rate limit tests
Collect requests information
Fuzz deep and wide
Evasive techniques
Attack authentication
Exploit authorisation
Inject with mass assignment
Try traditional injections

CTFs and challenges

Introduction
- What?
- Why?
- How?
RootMe: GraphQL Introspection

API mayhem

Ty Myrddin Home
Unseen University
Improbability Blog
About
Contact

Inject with mass assignment

Discover standard parameters used in requests
Inject

Previous Next

Unseen University, 2024, with a forest garden fostered by /ut7.