About Course
API Pentesting Course: Hack and Secure Modern APIs
This API pentesting course from TMG Security teaches you how to find and exploit security flaws in REST APIs, the backbone of every modern web and mobile app. You practise on custom-built vulnerable APIs, learn the OWASP API Security Top 10, and master Postman for API testing. As a result, you can find high-impact API bugs such as BOLA, mass assignment and broken authorization in real projects and bug bounty programs.
- OWASP API Top 10
- Postman testing
- Custom vulnerable APIs
- Real project testing
- API ID card
Requirements
-
The course starts from basics, however it is good to have basic knowledge of web applications pentesting.
Description
This course introduces students to the security concepts associated with APIs pentesting. In this courses we encourage you to take this course if you are a beginner in API pentesting security world. This course uses a custom developed vulnerable APIs pentesting to demonstrate how , API vulnerabilities can be identified and exploited. This course teaches you how to identify a variety of API vulnerabilities such as SQL Injection, XXE, Sensitive data in GET, Leaky APIs etc.
OWASP API PENTESTING
- Bola (broken object level authentication)
- Injection attack
- Improper assets management
- Security misconfiguration
- Mass assignment
- Broken function level authorization
- Excessive data exposure
- Broken user authentication
- API rate limiting
API-PENTESTING using postman tool
- Introduction $ installation
- Postman authentication
- Postman navigation
- OAUTH 2.0 authentication in postman
API PROJECT TESTING
- Access admin api/ access admin panel
- Brute-force apis to find new endpoints
- Make an account / loging to account
- Restore / delete everything
- Edit someone’s grade
- Transport layer security
- Blind xss in the admin control panel
- User enumeration
- Information exposure via server headers
- Authentication bypass
- Input validation attacks
- Sql injection
- Error handling
- Encryption
- Ssrf
- Bola
- Command injection
Benefits :
- Get ISO Certified Certification
- Get API Penetration Testing Badge ( ID CARD )
(Sample)
Point To Be Noted :
It takes minimum 3 months to get hard copy of ID CARD
Why choose this API pentesting course?
APIs are the new attack surface
Most apps now run on APIs, so API bugs are among the most common and best-paid findings in bug bounty.
Mapped to OWASP
First, learn every risk in the OWASP API Security Top 10, from BOLA to rate limiting.
Master Postman
Next, set up Postman, handle authentication including OAuth 2.0, and organise your API testing like a professional.
Hands-on project
Then, attack a full API project: brute-force hidden endpoints, access admin APIs and change data you should never reach.
Classic injection too
Exploit SQL injection, XXE, sensitive data in GET requests and leaky APIs on a custom vulnerable lab.
Bug bounty ready
Finally, apply the same methods on bug bounty programs. Bug bounty is our USP, so the course focuses on real, reportable bugs.
Who should take this API security testing course?
- Web pentesters who want to add API testing to their skill set.
- Bug bounty hunters who want to find high-impact API bugs.
- Backend developers who build APIs and want to secure them.
- Beginners with basic web pentesting knowledge.
New to web security? Start with our WAPT course first. Want more? Get web, API, Android and bug bounty together in the Red Teaming Bundle, or browse all TMG Security cybersecurity courses.
API pentesting course FAQ
What is API penetration testing?
API penetration testing means attacking an application’s APIs, with permission, to find flaws like broken authorization, data exposure and injection before attackers do.
Is this API pentesting course for beginners?
Yes. The course starts from the basics. However, basic knowledge of web application pentesting will help you get the most out of it.
Which vulnerabilities will I learn?
You will learn BOLA, mass assignment, broken function level authorization, excessive data exposure, broken user authentication, rate limiting issues, SQL injection, XXE and more.
Do I need Postman?
It helps. The course includes a full section on installing Postman, setting up authentication and testing APIs with it.
What do I get after the course?
You receive an ISO certified certificate and an ID card. Note that the hard copy of the ID card takes at least 3 months to arrive.
Course Content
Introduction to API PENTESTING
-
Join whatsapp Group
00:00
