Summary

Congratulations on reaching the end of this chapter – we have covered a lot of in-depth information on the practicality of attacking an API. At this point, you should have an appreciation for the fundamentals of many of the different attack types, and hopefully, you’re curious to try out some of these attacks yourself.

The attack techniques we covered align with the OWASP API Security Top 10 vulnerabilities, with a focus on authentication, authorization, and data-oriented attacks. By some measure, the most significant topic was the variety of ways in which authentication can be attacked and subverted in API systems — as a defender, this should be your first attack vector. Second only to authentication is the broad range of attacks that can be leveraged against authorization at both the object and function levels. We also learned key skills in attacking API data regarding both requests and responses. Finally, we covered a miscellany of attack types (injection...