So what does make APIs special and different? #apisecurity #apihacking #apis #pentesting

1) Interconnectedness, even if you're sure you don't have APIs, I bet your suppliers do
2) Large attack surfaces that are poorly documented, they balloon into hundreds of endpoints quickly

Let's explore the latest book by Packt Publishing on "Pentesting APIs" and see if it's worth putting on an API hacker's bookshelf.

#apihacking #apisecurity

https://danaepp.com/is-the-latest-book-on-pentesting-apis-any-good

Check out how to use upstream residential and mobile proxies in Burp Suite to evade IP blocking during your API security testing.

#apihacking #apisecurity

https://danaepp.com/evade-ip-blocking-by-using-residential-proxies

Let me show you how to use JSON injection to manipulate API payloads to control the flow of data and business logic within an API.

#apihacking #apisecurity

https://danaepp.com/attacking-apis-using-json-injection

Let me show you how to gain a competitive edge over other security researchers by detecting changes to APIs before others even know about them by using oasdiff.

#apihacking #apisecurity

https://danaepp.com/detecting-new-api-endpoints-with-oasdiff

Let's look at Tracfone's $16 million settlement with the FCC to understand why API security testing matters.

#apisecurity #apihacking

https://danaepp.com/why-api-security-testing-matters-learning-from-tracfone

Let me show you how to conduct covert data exfiltration within JSON payloads of an API response.

#apihacking #apisecurity

https://danaepp.com/covert-data-exfiltration-via-json-in-an-api

Let me show you how to fuzz JSON to find security vulnerabilities in the APIs you are hacking with the help of a custom wordlist and Param Miner.

#apihacking #apisecurity

https://danaepp.com/fuzzing-json-to-find-api-security-flaws