Category: API Hacking Techniques
-
Finding Hidden API Endpoints Using Path Prediction
Learn how to use contextual discovery and path prediction to find hidden API endpoints during your security testing.
-
API Security Testing using AI in Postman
Learn how to use the generative AI models built into Postman to quickly build tests to check for vulnerabilities in the APIs you are testing.
-
Mastering API Exploitation: Crafting Reverse Shells via cURL
Learn how to leverage a command injection vulnerability found in an API to gain a reverse shell to a server with nothing more than cURL.
-
My secret to API privesc: Tapping compromised web servers
Learn how to set up your own wiretaps on compromised web servers to remotely collect sensitive data for use in API privesc.
-
Here’s how I get the most out of Burp Suite reporting
Learn how to get the most out of the reporting capabilities built into PortSwigger’s Burp Suite Professional.
-
How to exploit an API using prototype pollution
Learn how to use server-side prototype pollution (SSPP) to abuse an API written in NodeJS for privilege escalation and remote code execution.
-
Avoiding the Apocalypse: A Guide to Finding Zombie APIs
Learn how to look for those old forgotten zombie APIs that can be a goldmine of vulnerabilities and security loopholes.
-
Cross-Tenant Data Leaks (CTDL): Why API Hackers Should Be On The LookOut
Learn how to find vulnerabilities in multi-tenant apps and APIs that expose cross-tenant data leaks (CTDL) during your security testing.
-
Attacking APIs by tainting data in weird places
Discover ways to modify API requests during testing to corrupt data and manipulate code flow, allowing you to uncover new vulnerabilities.
-
Finding API secrets in hidden layers within Docker containers
Learn how to find and extract sensitive secrets and source code to APIs hidden within the layers of Docker container images.