You're reading from Pentesting APIs A practical guide to discovering, fingerprinting, and exploiting APIs

Product type Paperback

Published in Sep 2024

Publisher Packt

ISBN-13 9781837633166

Length 290 pages

Edition 1st Edition

Concepts

Cybersecurity

Author (1):

Maurício Harley

View More author details

Table of Contents (18) Chapters

Preface

1. Part 1: Introduction to API Security

2. Chapter 1: Understanding APIs and their Security Landscape FREE CHAPTER

3. Chapter 2: Setting Up the Penetration Testing Environment

4. Part 2: API Information Gathering and AuthN/AuthZ Testing

5. Chapter 3: API Reconnaissance and Information Gathering

6. Chapter 4: Authentication and Authorization Testing

7. Part 3: API Basic Attacks

8. Chapter 5: Injection Attacks and Validation Testing

9. Chapter 6: Error Handling and Exception Testing

10. Chapter 7: Denial of Service and Rate-Limiting Testing

11. Part 4: API Advanced Topics

12. Chapter 8: Data Exposure and Sensitive Information Leakage

13. Chapter 9: API Abuse and Business Logic Testing

14. Part 5: API Security Best Practices

15. Chapter 10: Secure Coding Practices for APIs

16. Index

Why subscribe?

17. Other Books You May Enjoy

Preface

Welcome to Pentesting APIs! Application Programming Interfaces (APIs) are pervasive in the modern world we live in. It’s practically impossible to use a web, embedded, or mobile application without interacting with its API. Understanding its weaknesses is fundamental for a well-done invasion test. That’s what this book is all about.

You will learn various aspects of APIs, beginning with a quick introduction to them and their history, going through basic and advanced attacks, exploring different code excerpts and techniques, and finishing with security recommendations on how to block or avoid such attacks. Hence, this book is divided into the following main sections:

Recognizing and scanning API targets.
Effectively attacking APIs.
Learning recommendations on how to protect APIs from invasions.

I will guide you through all the steps that are necessary to exercise professional pentesting against API targets. This is based on the following:

My accumulated experience as an application security engineer, where I was responsible for reviewing various security aspects of applications before approving them for public release.
My previous and current professional experiences with software development, especially on security software, such as keys and secrets management as well as identity management.

Recent news highlights the growing importance of API security. In late 2022, a major social media platform suffered a data breach due to vulnerabilities in its API, exposing millions of user records. Similarly, in early 2023, a financial services company faced a significant security incident where hackers exploited API flaws to siphon off sensitive customer data. These incidents underscore the critical need for rigorous API pentesting to identify and mitigate vulnerabilities before they can be exploited by malicious actors.

By comprehensively understanding and addressing API security, organizations can significantly enhance their defense against potential cyber threats. You are about to begin this fascinating journey.