For direct assistance contact us! +91-9999508202 [email protected]

API Exploitation and Security

 The modern application uses the API for the calling micro-services or performing the actions or monitoring the user’s behaviors. The design or the structure of the API is exposed to the customers or application user. Due to this nature of the API, the attacker can understand the structure of the API and use this information attack API further.The REST API uses the different processing requests such as GET, POST, PUT, DELETE, HEAD, and PATCH actions. The attacker can modify the request headers for understanding the API and use this understanding to craft entirely working weaponized exploit. The processing request can be altered, and as a best practice of the processing request must be not be tampered or modified .

This API exploitation and security course is designed for core professionals and learns who focus more on implementation and security of API endpoints and communications . This practical training is designed with hands on practical use cases .



API hacking and Security









API Exploitation and Security - APIES-912 1
module 1 : Introduction to API Security
  • Introduction to API
  • Different Approach to API Security Testing
  • Challenges in API Security Testing
  • Tools and Frameworks for API Security Testing
  • Traditional API testing v/s API Security testing
API Exploitation and Security - APIES-912 2
module 2 : GRC & Code quality in API security
  • Primary Goal of API GRC
  • The need for API GRC
  • API development vs Web Apps
  • API GRC throughout design, implementation & runtime operation
  • Security Review of APIs Documentations
  • Understanding API-Based Platforms
API Exploitation and Security - APIES-912 3
module 3 : Getting Started with API Security Testing
  • Setup API Live Test Case Environment
  • API Penetration Testing Methodologies
  • API Security Testing Checklists
  • API Audit control checklists
  • Security Audit of MobileApp API and WebApp API
API Exploitation and Security - APIES-912 4
module 4 : Discovering Leaky APIs | Hidden APIs - Reconnaissance
  • Configure Fiddler to find Sensitive and leaky APIs
  • Configure Burpsuite to Security test of Hidden APIs
  • Proxying Device Traffic Through Fiddler | Burpsuite
  • Discovering More About Mobile Apps via Fiddler Discovering Hidden APIs via Documentation Pages
  • Discovering Hidden APIs via Search Engine
  • Discovering Hidden APIs via robots.txt
  • Discovering Leaky APIs – UserID Endpoint
  • Discovering Leaky APIs – User Input Endpoint
  • Discovering Leaky APIs – User Interaction Endpoint
  • Personally Identifiable Information (PII) Disclosure 
API Exploitation and Security - APIES-912 5
module 5 : API Authentication and Authorization Vulnerabilities
  • Use Cases : Various OAuth Misconfiguration
  • Use Cases : OAuth Authorization Bypass
  • Use Cases : Account takeover Issues
  • Improper Restriction of Unprotected APIs Endpoint
  • Transporting API Auth tokens as Cleartext Allowed
  • Improper Restriction of Misconfigured API
  • Insufficient Entropy For Random Values
  • Leakage of API Authentication Tokens
  • Improper Access Control


API Exploitation and Security - APIES-912 5
module 6 : API attack kung-gu
  • Use Cases : XML External Entity (XXE) Processing
  • Use Cases : HTTP Parameter Pollution Attacks
  • Use Cases : Cross-site Scripting (XSS)
  • Use Cases : Common Injection Attacks
  • Use Cases : Command Injection
  • Use Cases : SQL injection
  • Use Cases : Insecure Direct Object Reference(IDOR)
  • Use Cases : Cross-Origin Resource Sharing (CORS)
  • Use Cases : Cross-Site Request Forgery (CSRF)
  • Use Cases : Open Redirection Vulnerability
  • Use Cases : Privilege escalation Issues
  • Use Cases : Local File Inclusion (LFI)
  • Use Cases : Remote File Inclusion(RFI)
  • Use Cases : Input validation Issues
  • Manipulating App Logic by Request Tampering
  • Response Tampering


API Exploitation and Security - APIES-912 5
module 7 : API Security Top 10 OWASP
  • OWASP API Security Vulnerabilities – Hands on lab
  • Testing for Broken Function Level Authorization
  • Testing for Broken Object Level Authorization
  • Testing for Lack of Resources & Rate Limiting
  • Testing for Broken User Authentication
  • Testing for Improper Assets Management
  • Testing for Security Misconfiguration
  • Testing for Excessive Data Exposure
  • Testing for Mass Assignment


API Exploitation and Security - APIES-912 5
module 7 : production report writing
  • Executive summery 
  • Manual report writing methodologies 


who should attend this training?
  • Freshers
  • Ethical hackers

  • System Administrators

  • Network Administrators

  • Engineers

  • Web Developers

  • Bug bounty hunters 

  • Security Professionals

why should i take this training?

learn detailed concepts of API exploitation & security concepts with practical use cases

prerequisite of the training ?
The person should familiar with basic computer operations and programming.
what is the total duration of this training ?
Its an Instructor-led online training and the total duration of the training is 45 hours.

APi Exploitation and

Security training enquiry




8 + 13 =

Our clients


Today I’ve completed my one 2 one online training by Mr Naresh sir from Certcube Labs .
This is the first time I have attended a class in this format and wondered how effective it would be. It was very effective and therefore I would definitely be interested in attending other classes in the same format. The instructor was very knowlegeable and provided a wealth of information about the current version, especially since the last version I used was several releases ago.
Satyam Singh

BCA, Delhi University

A good place to learn every small detail in cybersecurity.Really nice and helpful teacher.

Btech, BITS Mesra

Register with us for APIES-912 training

11 + 2 =