Summary

This chapter covered additional topics relating to an API pentest. We have looked at both the AuthN and AuthZ mechanisms, their details, and ways they can present themselves as vulnerable enough to be exploitable. You also learned about weak API credentials and default accounts, along with techniques to discover and leverage them as part of your attack. These constitute a very important part of any API pentest since other stages, such as persistence, lateral movement, and data exfiltration all depend on the successful exploitation of AuthN and AuthZ.

In the next chapter, which also starts Part 3 of this book, you will be introduced to injection attacks and validation testing. The damage such attacks can cause can be massive and successfully protecting against them by implementing a correct user input validation is key. See you there!