Pentesting APIs (Maurício Harley)（Z-Library）

【One-Line Pitch】 A structured, hands-on field guide to discovering, fingerprinting, and exploiting RESTful and GraphQL APIs, written for security practitioners who already know their way around a pentest lab. If you are a pentester, AppSec engineer, or developer who needs to understand how APIs break—and how to stop it—this is a sequenced path from reconnaissance to remediation. 【Book Arc】 - **Opening (~0%–10%)**: Frames why API security matters now, using real-world breach examples to argue that APIs are the backbone of modern applications and therefore prime attack targets. Introduces the author's three-part plan: recognize and scan targets, attack APIs effectively, then learn how to protect them. - **Early (~10%–35%)**: Builds the conceptual foundation—what an API actually is, its components (definitions, protocols, documentation), a brief history from RPC to Web 3.0, and the major protocol families (SOAP, REST, gRPC, JSON-RPC, GraphQL). Also covers lab setup: tool selection, Docker, OWASP software, Burp Suite, Postman, Wireshark, and a working test environment. - **Early–Middle (~35%–50%)**: Moves into reconnaissance and information gathering—enumerating and identifying APIs, analyzing documentation and endpoints, leveraging OSINT, and mapping data and schema structures. Then pivots to authentication and authorization testing: API keys, basic auth, OAuth, session tokens, JWTs, weak/default credentials, brute force, RBAC vs. ABAC, OAuth scopes, and access-control bypasses like BOLA and BFLA. - **Middle (~50%–65%)**: Covers injection and validation testing in depth—classic, stacked, union, hidden union, and Boolean SQL injection; NoSQL syntax, object, and operator injection; plus input validation and sanitization for registration, query parameters, file uploads, numeric input, and XSS prevention. - **Late (~65%–90%)**: Continues through the remaining basic and advanced attack categories, applying techniques against deliberately vulnerable targets such as WebGoat and crAPI, with code excerpts and exploitation walkthroughs. - **Ending (~90%–100%)**: Closes with defensive guidance—secure coding approaches, standards, and practical recommendations for blocking or avoiding the attacks demonstrated earlier. The excerpts do not cover the exact final chapter structure beyond this. 【Key Takeaways】 - **APIs are the dominant attack surface of modern applications** (Opening): the book opens by arguing that nearly every web, mobile, or embedded app depends on APIs, making them a high-value target and a required skill for pentesters. - **A sequenced methodology beats tool-hopping** (Early): the author explicitly structures the work as recognize/scan → attack → protect, so readers learn a repeatable process rather than a bag of tricks. - **Protocol fluency drives test design** (Early–Middle): SOAP, REST, gRPC, JSON-RPC, and GraphQL each have distinct structures and weaknesses; understanding definitions, protocols, and documentation is treated as prerequisite knowledge. - **Reconnaissance is where APIs are won or lost** (Middle): enumerating endpoints, reading documentation, using OSINT, and mapping schemas are presented as the foundation before any exploitation begins. - **AuthN/AuthZ flaws are the core API weakness class** (Middle): the book devotes substantial space to API keys, OAuth, JWTs, session tokens, and especially BOLA/BFLA access-control bypasses—the vulnerabilities most likely to expose real data. - **Injection remains alive and well in APIs** (Middle): SQL and NoSQL injection variants are demonstrated against vulnerable APIs, alongside input validation and sanitization as the corresponding defense. - **Practice happens against real vulnerable targets** (Late): WebGoat and crAPI are used as hands-on labs, with code excerpts and exploitation steps rather than purely theoretical descriptions. - **Every attack chapter pairs with a defensive lesson** (Ending): the book finishes with secure coding standards and recommendations, reinforcing that the goal is protection, not just exploitation. 【Reading Tips】 - **Skim the history and protocol survey if you already know REST vs. GraphQL**, but deep-read the component breakdown (definitions, protocols, documentation) if you are new to APIs—it underpins everything later. - **Do not skip the lab setup chapter.** The book assumes a working environment with Docker, Burp Suite, Postman, Wireshark, and OWASP tooling; setting this up early makes the exploitation chapters far more useful. - **Treat the AuthN/AuthZ and injection chapters as the core.** These are the highest-value sections for real engagements; work through the BOLA/BFLA and SQL/NoSQL examples slowly and reproduce them. - **Use WebGoat and crAPI actively.** The book is designed around hands-on practice; reading exploitation steps without executing them will not build the skill. - **Read the final defensive chapter even if you are offense-focused.** It translates each attack class into concrete secure-coding and validation guidance, which is useful for reporting and remediation advice. 【Coverage Limits】 This guide is based on stratified excerpts covering the front matter, table of contents, introductory chapters, and portions of the reconnaissance, authentication/authorization, and injection material. The excerpts do not cover the full advanced attack chapters, the complete defensive chapter, or specific exploitation details beyond what is summarized here.