Skip to main content

REST API Penetration

40 hours 7 Modules 20+ Labs Intermediate

Course Description​

REST APIs power modern applications. Learn comprehensive API security testing methodologies and exploitation techniques.

Learning Objectives​

  1. Enumerate API endpoints
  2. Bypass authentication mechanisms
  3. Exploit authorization flaws
  4. Perform injection attacks
  5. Test rate limiting
  6. Discover sensitive data exposure

Course Structure​

Modules​

Module 1: REST API Fundamentals (5h)​

  • REST architecture
  • HTTP methods
  • Status codes
  • Content types
  • API documentation

Module 2: Reconnaissance (6h)​

  • Endpoint discovery
  • Documentation analysis
  • Swagger/OpenAPI
  • Hidden endpoints

Module 3: Authentication Testing (7h)​

  • JWT attacks
  • OAuth vulnerabilities
  • API key exposure
  • Session management

Module 4: Authorization Testing (6h)​

  • BOLA/IDOR
  • BFLA attacks
  • Privilege escalation
  • Resource isolation

Module 5: Injection Attacks (6h)​

  • SQL injection
  • NoSQL injection
  • Command injection
  • SSRF attacks

Module 6: Rate Limiting (5h)​

  • Rate limit bypass
  • Resource exhaustion
  • Brute force attacks
  • Account enumeration

Module 7: Business Logic (5h)​

  • Mass assignment
  • Race conditions
  • Parameter pollution
  • Data exposure

Tools​

ToolPurpose
PostmanAPI testing
Burp SuiteProxy & testing
InsomniaAPI client
OWASP ZAPScanning
ArjunParameter discovery