Summary
In this more practical chapter, we had good coverage on DoS and DDoS, which can be used to discover vulnerabilities on target API endpoints. We then moved forward and learned how we detect when rate-limiting controls are in place (they can filter DoS attacks). We finished the chapter by crafting some Python code that, by imposing delays between requests and changing the source IP addresses, successfully bypassed the rate-limiting mechanism that was previously blocking them.
In the next chapter, we will start a new part where we will discover advanced topics on pentesting APIs. We begin by understanding how successful invasions can cause data exposure and sensitive information leakage.
