Book
Hacking APIs
Breaking Web Application Programming Interfaces
Corey Ball
Summary
Corey Ball, a cybersecurity consulting manager with a decade in penetration testing, wrote this as a hands-on course in breaking REST and GraphQL APIs rather than a general web security survey. It works through reconnaissance and endpoint discovery with tools like Kiterunner and OWASP Amass, then into vulnerabilities specific to APIs: BOLA and BFLA (broken object- and function-level authorization), mass assignment, injection, and authentication flaws, the same weaknesses behind a large share of API bug bounty payouts. The premise is that understanding these attacks well enough to execute them is what lets you design authorization checks that actually hold, rather than ones that only look complete on a diagram.
Target Readers
- Developers designing API authorization who want to understand BOLA and mass assignment from the attacker's side before they ship
- Security engineers moving from web application penetration testing into API-specific testing tools and techniques
- Bug bounty hunters targeting API endpoints who need a structured methodology, not just a list of vulnerability names
Tags
Colophon
- Publisher
- O'Reilly Japan
- ISBN
- 978-4-8144-0024-9
- Published
- Mar 2023
- List price
- ¥4,400incl. taxMay differ from the actual selling price on Amazon
Get this book
* The link above is an advertisement via Amazon Associates.Related Books
Prerequisites
- Recommended
Grokking Web Application Security
Malcolm McDonald
Reason: Once the principles of defense are solid, adopt the attacker's view. Learning API vulnerabilities (BOLA/IDOR, etc.) — now the main battleground for SPAs and microservices — from the offensive side lets you work backward to robust API design.
- Related
Secure APIs
Design, build, and implement
José Haro Peralta
Reason: After learning to defend APIs from the design stage with a shift-left mindset, check from the attacker's side whether that design actually holds up. Learning authorization-gap vulnerabilities like BOLA/IDOR from the offensive side lets you work backward to reassess the robustness of your design.