Hacking APIs: Breaking Web Application Programming Interfaces

Hacking APIs: Breaking Web Application Programming Interfaces

  • Downloads:6928
  • Type:Epub+TxT+PDF+Mobi
  • Create Date:2022-07-18 06:51:35
  • Update Date:2025-09-06
  • Status:finish
  • Author:Corey J Ball
  • ISBN:1718502443
  • Environment:PC/Android/iPhone/iPad/Kindle

Summary

Hacking APIs is a crash course in web API security testing that will prepare you to penetration-test APIs, reap high rewards on bug bounty programs, and make your own APIs more secure。

Hacking APIs is a crash course on web API security testing that will prepare you to penetration-test APIs, reap high rewards on bug bounty programs, and make your own APIs more secure。

You'll learn how REST and GraphQL APIs work in the wild and set up a streamlined API testing lab with Burp Suite and Postman。 Then you'll master tools useful for reconnaissance, endpoint analysis, and fuzzing, such as Kiterunner and OWASP Amass。 Next, you'll learn to perform common attacks, like those targeting an API's authentication mechanisms and the injection vulnerabilities commonly found in web applications。 You'll also learn techniques for bypassing protections against these attacks。

In the book's nine guided labs, which target intentionally vulnerable APIs, you'll practice:
- Enumerating APIs users and endpoints using fuzzing techniques
- Using Postman to discover an excessive data exposure vulnerability
- Performing a JSON Web Token attack against an API authentication process
- Combining multiple API attack techniques to perform a NoSQL injection
- Attacking a GraphQL API to uncover a broken object level authorization vulnerability

By the end of the book, you'll be prepared to uncover those high-payout API bugs other hackers aren't finding and improve the security of applications on the web。

Download

Reviews

Tim O'Hearn

I can confidently say that if I encountered this as a 13 year old Googling how to be a computer hacker, the book likely would have changed the course of my life。 Even if you are not particularly interested in API security or building cross-API products, Hacking APIs scratches that primal itch to break in and break things。There is immense value in some of the products and services built upon the exploitation of APIs。 As a result, there is very little reciprocity between teachers and students。 Sha I can confidently say that if I encountered this as a 13 year old Googling how to be a computer hacker, the book likely would have changed the course of my life。 Even if you are not particularly interested in API security or building cross-API products, Hacking APIs scratches that primal itch to break in and break things。There is immense value in some of the products and services built upon the exploitation of APIs。 As a result, there is very little reciprocity between teachers and students。 Shady characters hound experienced engineers and pen testers, carve out their little niches, and then disappear。 Everyone seems to be in it for themselves aside from Corey Ball。I've created some useful and profitable systems, including one powered by my own version of the AWS IP rotator described at the end of chapter 13。 It's weird yet gratifying seeing nearly identical step-by-step instructions for something I built years ago appear in a book and be available to a wider audience (to be clear: IP-based rate limiting isn't a hard problem, just one that someone with no programming experience would have no idea how to solve)。 While I'm not truly an expert and have been a shadowy profiteer, the effort behind this book must have been immense。 I have no doubt that the author has mastered this subject。Hacking APIs receives a strong recommendation from this washed-up reviewer。 。。。more