When most people think about penetration testing, they imagine someone aggressively firing payloads at a system until something breaks.

So, what is an API?

I’ve read enough security reports to know how they usually go. Big numbers, familiar vulnerabilities and lightly repackaged advice.

In the world of API security, one vulnerability consistently sits at the top of the OWASP Top 10 list: BOLA (Broken Object Level…

Welcome back to my API pentesting series! In this third blog, we’re diving into BOLA (Broken Object Level Authorization) — the #1 API…

Chaining API weaknesses to gain deeper access and expose data

Hello readers! I’m Mohamed Reda, and today we will walk through how to solve the first lab in PortSwigger’s API testing academy…

Introduction

A beginner’s guide to API testing with zero assumed knowledge

In this lab from PortSwigger’s Web Security Academy, the goal was simple: find the hidden private blog post and extract its secret…

Part 2 of a 2-part series on JWT attacks against crAPI — [catch up on Part 1 here]

Author: LibanTheHckr63

We use dozens of APIs every day without even realizing it. Whether we are ordering food, checking our bank accounts, or booking a hotel…