API Exploitation and Security
The modern application uses the API for the calling micro-services or performing the actions or monitoring the user’s behaviors. The design or the structure of the API is exposed to the customers or application user. Due to this nature of the API, the attacker can understand the structure of the API and use this information attack API further.The REST API uses the different processing requests such as GET, POST, PUT, DELETE, HEAD, and PATCH actions. The attacker can modify the request headers for understanding the API and use this understanding to craft entirely working weaponized exploit. The processing request can be altered, and as a best practice of the processing request must be not be tampered or modified .
This API exploitation and security course is designed for core professionals and learns who focus more on implementation and security of API endpoints and communications . This practical training is designed with hands on practical use cases .
REAL LIFE CASE STUDIES
INSTRUCTOR-LED SESSIONS
INDUSTRY DRIVEN CERTIFICATION
DAILY ASSIGNMENTS
STUDENT LEARNING KIT
syllabus
syllabus
module 1 : Introduction to API Security
- Introduction to API
- Different Approach to API Security Testing
- Challenges in API Security Testing
- Tools and Frameworks for API Security Testing
- Traditional API testing v/s API Security testing
module 2 : GRC & Code quality in API security
- Primary Goal of API GRC
- The need for API GRC
- API development vs Web Apps
- API GRC throughout design, implementation & runtime operation
- Security Review of APIs Documentations
- Understanding API-Based Platforms
module 3 : Getting Started with API Security Testing
- Setup API Live Test Case Environment
- API Penetration Testing Methodologies
- API Security Testing Checklists
- API Audit control checklists
- Security Audit of MobileApp API and WebApp API
module 4 : Discovering Leaky APIs | Hidden APIs - Reconnaissance
- Configure Fiddler to find Sensitive and leaky APIs
- Configure Burpsuite to Security test of Hidden APIs
- Proxying Device Traffic Through Fiddler | Burpsuite
- Discovering More About Mobile Apps via Fiddler Discovering Hidden APIs via Documentation Pages
- Discovering Hidden APIs via Search Engine
- Discovering Hidden APIs via robots.txt
- Discovering Leaky APIs – UserID Endpoint
- Discovering Leaky APIs – User Input Endpoint
- Discovering Leaky APIs – User Interaction Endpoint
- Personally Identifiable Information (PII) Disclosure
module 5 : API Authentication and Authorization Vulnerabilities
- Use Cases : Various OAuth Misconfiguration
- Use Cases : OAuth Authorization Bypass
- Use Cases : Account takeover Issues
- Improper Restriction of Unprotected APIs Endpoint
- Transporting API Auth tokens as Cleartext Allowed
- Improper Restriction of Misconfigured API
- Insufficient Entropy For Random Values
- Leakage of API Authentication Tokens
- Improper Access Control
module 6 : API attack kung-gu
- Use Cases : XML External Entity (XXE) Processing
- Use Cases : HTTP Parameter Pollution Attacks
- Use Cases : Cross-site Scripting (XSS)
- Use Cases : Common Injection Attacks
- Use Cases : Command Injection
- Use Cases : SQL injection
- Use Cases : Insecure Direct Object Reference(IDOR)
- Use Cases : Cross-Origin Resource Sharing (CORS)
- Use Cases : Cross-Site Request Forgery (CSRF)
- Use Cases : Open Redirection Vulnerability
- Use Cases : Privilege escalation Issues
- Use Cases : Local File Inclusion (LFI)
- Use Cases : Remote File Inclusion(RFI)
- Use Cases : Input validation Issues
- Manipulating App Logic by Request Tampering
- Response Tampering
module 7 : API Security Top 10 OWASP
- OWASP API Security Vulnerabilities – Hands on lab
- Testing for Broken Function Level Authorization
- Testing for Broken Object Level Authorization
- Testing for Lack of Resources & Rate Limiting
- Testing for Broken User Authentication
- Testing for Improper Assets Management
- Testing for Security Misconfiguration
- Testing for Excessive Data Exposure
- Testing for Mass Assignment
module 7 : production report writing
- Executive summery
- Manual report writing methodologies
who should attend this training?
- Freshers
-
Ethical hackers
-
System Administrators
-
Network Administrators
-
Engineers
-
Web Developers
-
Bug bounty hunters
-
Security Professionals
why should i take this training?
learn detailed concepts of API exploitation & security concepts with practical use cases
prerequisite of the training ?
what is the total duration of this training ?
APi Exploitation and Security Details
Whats Next ?
Checkout the advanced training modules with the given below link.
Testimonials
This is the first time I have attended a class in this format and wondered how effective it would be. It was very effective and therefore I would definitely be interested in attending other classes in the same format. The instructor was very knowlegeable and provided a wealth of information about the current version, especially since the last version I used was several releases ago.