Foundations of Attacking APIs

In this chapter, the focus turns to the foundational issues associated with attacking APIs. Firstly, we will understand the different ways that an attacker can exploit an API using methods that include passive monitoring (discovery) and active interception, including the modification of requests and responses. We will then focus on a selection of the most important tools available to an aspiring API attacker and demonstrate how these can be used to perform core attacks, such as cracking passwords or tokens. Finally, we will combine this knowledge to build our own hacking laboratory and commence attacking some popular vulnerable APIs.

This chapter will equip you with the foundational knowledge used by API hackers—there are a vast array of tools and techniques available to a budding attacker, and it is important to know the relative value of different tools and techniques for a given attack scenario.

In a nutshell, this chapter is going to cover...