The newest API Security resources are on the API Security page. For a reading order instead of a date order, see the API Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-11 2026 | PayloadsAllTheThings: API Key Leaks intermediate 2 min read | Library of resources for identifying and managing API key leaks, including tools like aquasecurity/trivy, blacklanternsecurity/badsecrets, irsdl/crapsecrets, d0ge/sign-saboteur, mazen160/secrets-patterns-db, momenbasel/KeyFinder, streaak/keyhacks, trufflesecurity/truffleHog, and projectdiscovery/nuclei-templates. It covers common leak vectors such as hardcoding in source code, public repositories, Docker images, logs, and configuration files, offering techniques to detect and verify leaked credentials. |
| 2026-04-11 2026 | State of Secrets: 28 Million Credentials Leaked on GitHub in 2025 news 17 min read Secrets | Library for detecting and preventing hardcoded secrets in code, addressing accidental commits, the .env file problem, supply chain attacks via compromised NPM packages like tinyColor and ngx-bootstrap, leaks from non-code surfaces such as Slack and Jira, and the increasing risks associated with AI-assisted development and MCP server configurations. → snyk.io |
| 2026-04-11 2026 | Bypassing Rate Limits: All Known Techniques intermediate | Bypassing Rate Limits: All Known Techniques |
| 2026-04-11 2026 | Rate Limit Bypass - HackTricks intermediate 6 min read | Library detailing rate limit bypass techniques. This resource explores methods including brute-forcing variations of endpoints like `/api/v3/sign-up`, inserting blank bytes, and modifying headers such as `X-Forwarded-For` to evade IP-based rate limiting. It also covers bypassing limits by altering user-agent and cookie headers, adding non-significant parameters, and leveraging HTTP/2 multiplexing and GraphQL batching. Advanced techniques like using WebSocket or gRPC streaming, sharding counters across multiple regions, and utilizing tools like PortSwigger's Turbo Intruder and `websocat` are also discussed. → book.hacktricks.xyz |
| 2026-04-11 2026 | Hacking APIs: Bypassing Rate Limiting intermediate | Hacking APIs: Bypassing Rate Limiting |
| 2026-04-11 2026 | What is Mass Assignment? Attacks and Security Tips beginner 4 min read | Guide to Mass Assignment vulnerabilities, also known as autobinding or object injection, detailing how attackers can manipulate HTTP request parameters to modify or create unintended object variables. It illustrates attacks, including privilege escalation via user profile modification on platforms like GitHub (2012) and GraphQL API exploitation, and provides prevention techniques such as implementing strict field whitelisting on the server-side, referencing OWASP for framework-specific solutions. → vaadata.com |
| 2026-04-11 2026 | API Security 101: Mass Assignment and Exploitation in the Wild beginner 4 min read | Guide to exploiting mass assignment vulnerabilities in APIs, covering its impact on privilege escalation and financial abuse. This guide details how mass assignment functions in frameworks like Ruby on Rails, NodeJS, Spring MVC, ASP NET MVC, and PHP, and demonstrates exploitation techniques using examples and the crAPI demo lab. It also outlines remediation strategies such as disabling automatic property mapping and implementing read-only fields. → cobalt.io |
| 2026-04-11 2026 | What is BOLA? 3-digit bounty from Topcoder beginner | What is BOLA? 3-digit bounty from Topcoder → infosecwriteups.com |
| 2026-04-11 2026 | API1:2023 Broken Object Level Authorization beginner 3 min read | Analysis of API1:2023 Broken Object Level Authorization examines how applications fail to validate permissions for every API call to every object. Attackers manipulate object IDs in API requests to access unauthorized data or functionality, leading to potential data breaches, account takeovers, or permission escalation. Detecting and mitigating BOLA vulnerabilities through code changes and inline API security tools like Wallarm is crucial for preventing these impacts. |
| 2026-04-11 2026 | Exposing a New BOLA Vulnerability in Grafana intermediate 8 min read | Writeup on CVE-2024-1313, a Broken Object Level Authorization (BOLA) vulnerability in Grafana, allows low-privileged users to delete dashboard snapshots from other organizations using snapshot keys. Versions 9.5.0 before 9.5.18, 10.0.0 before 10.0.13, 10.1.0 before 10.1.9, 10.2.0 before 10.2.6, and 10.3.0 before 10.3.5 are affected. The vulnerability, with a CVSS score of 6.5, arises from the dashboard snapshot APIs and could lead to data loss or integrity issues. Additionally, an endpoint allows any user to create snapshots with weak self-assigned keys, potentially enabling denial-of-service or brute-force attacks. → unit42.paloaltonetworks.com |
| 2026-04-10 2026 | Doyensec: Common OAuth Vulnerabilities intermediate 13 min read AuthN | Checklist of common OAuth vulnerabilities, this resource details attacks against the protocol's implementations. It explains the Implicit Flow, Authorization Code Flow, Authorization Code Flow with PKCE, Client Credentials Flow, Device Authorization Flow, and the Resource Owner Password Credentials Flow. Common attack vectors like XSS and flawed redirect_uri validation are highlighted, particularly in the Implicit Flow. → blog.doyensec.com |
| 2026-04-10 2026 | API Exploitation For Bug Bounty intermediate | API Exploitation For Bug Bounty |
| 2026-04-10 2026 | API Penetration Testing Roadmap (2025) beginner 1 min read | Roadmap for API penetration testing covering REST, SOAP, and GraphQL, detailing techniques for identifying Broken Authentication, Rate Limiting Bypasses, Injection Attacks (SQLi, XSS, SSTI), and Business Logic Vulnerabilities. It emphasizes hands-on practice with tools like Burp Suite, Postman, and OWASP ZAP, alongside learning from platforms such as PortSwigger's Web Security Academy, APIsec University, and bug bounty reports from HackerOne. The roadmap stresses practical application on live systems and understanding OWASP API Security Top 10 principles. |
| 2026-04-10 2026 | API Security Testing Tool Checklist (2026) beginner 7 min read | Library for API security testing, this resource outlines essential features for modern application security. It emphasizes robust authentication support, including OAuth2, JWT, and multi-step workflows, alongside schema import capabilities for OpenAPI, Swagger, and Postman collections to ensure comprehensive coverage of REST, GraphQL, and Async APIs. The checklist highlights the importance of rate limiting and safe scan controls to prevent operational disruption, continuous environment support across CI/CD and staging, and noise reduction through proof of exploitability. Key vulnerabilities addressed include Broken Object Level Authorization (BOLA) and business logic abuse, stressing workflow-level testing over basic scanning for effective API security. → brightsec.com |
| 2026-04-10 2026 | GraphQL Security Best Practices: A Developer's Guide beginner 15 min read | Guide to GraphQL security best practices detailing risks like query depth and complexity attacks, introspection abuse, batching exploits, and field-level authorization challenges. It explains how GraphQL's flexible query language and single endpoint architecture differ from REST, creating unique attack surfaces. The guide covers mitigations for these issues, crucial for developers securing GraphQL services. |
| 2026-04-10 2026 | OWASP API Security Top 10 Risks beginner 8 min read | Reference detailing the OWASP API Security Top 10 Risks, updated in 2023 to reflect evolving threats. This includes risks like Broken Object Level Authorization (BOLA), Broken Authentication, Broken Object Property Level Authorization (BOPLA), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery (SSRF), and Security Misconfiguration. The document offers mitigation strategies for these vulnerabilities, citing examples like Uber and Trello breaches. → wiz.io |
| 2026-04-10 2026 | API Security Reality Check: Q2 2025 API ThreatStats Report news 3 min read | Report detailing Q2 2025 API security trends, highlighting a 9.8% increase in API CVEs and a significant rise in AI-specific API vulnerabilities, with 34 new CVEs. The report addresses the hidden risks of GraphQL, where despite no reported breaches, vulnerabilities like excessive data exposure and denial of service from nested queries are prevalent due to poor visibility and traditional tool limitations. Most exploited flaws include unauthenticated access, Broken Object Level Authorization (BOLA), token abuse, and injection risks, emphasizing the need for complete API visibility, securing AI stacks, strengthening authorization, and comprehensive lifecycle testing beyond schema validation. |
| 2026-04-10 2026 | GraphQL Security Testing: Complete Guide intermediate 12 min read | Library for securing GraphQL APIs, addressing unique vulnerabilities like schema exposure via introspection and Apollo suggestions, deeply nested query attacks, missing field-level authorization (BOLA) and IDOR via argument manipulation, SQL injection through variables, and batch query attacks. It highlights how these differ from REST APIs and provides actionable insights for mitigation, emphasizing the need for per-object authorization and query complexity limits. |
| 2026-04-10 2026 | Common API Security Vulnerabilities & Solutions (2026 Guide) beginner 15 min read | Guide on common API security vulnerabilities, covering the OWASP API Top 10 including BOLA, BFLA, Mass Assignment, and Excessive Data Exposure. It details real-world exploits like JWT misuse and GraphQL abuse, emphasizing the need for active testing beyond static scans. Solutions discussed include strong access controls (RBAC/ABAC), secure authentication with MFA and OAuth 2.0, limiting data exposure, implementing rate limiting, and secure configurations to mitigate breaches and financial losses. |
| 2026-04-10 2026 | Common Attacks on REST APIs and GraphQL APIs beginner GraphQL | Common Attacks on REST APIs and GraphQL APIs |
| 2026-04-10 2026 | GraphQL API Security: Common Vulnerabilities and Exploits intermediate GraphQL | GraphQL API Security: Common Vulnerabilities and Exploits |
| 2026-04-10 2026 | API Security Risks: The 10 Most Exploited in 2026 news 10 min read | Library cataloging the top 10 API security risks for 2026, detailing threats like AI-powered attacks, injection attacks (SQL, XSS), supply chain compromise, shadow APIs, Broken Object-Level Authorization (BOLA), and GraphQL vulnerabilities. The entry highlights real-world breaches including Azure AD user data exposure, Facebook account data theft via API authentication bypass, Stripe API hijacking for Magecart attacks, Intel employee data exfiltration, and OpenAI customer data exposure through Mixpanel. It emphasizes emerging vectors and the critical need for API posture governance strategies. |
| 2026-04-10 2026 | What Are the OWASP Top 10 API Security Risks? - Akamai beginner | What Are the OWASP Top 10 API Security Risks? - Akamai → akamai.com |
| 2026-04-10 2026 | OWASP API Security Top 10 (2025) Guide with Tests beginner 25 min read | Reference detailing the OWASP API Security Top 10 (2023) standard, including explanations and testing strategies for vulnerabilities such as Broken Object Level Authorization (BOLA), Broken Object Property Level Authorization (BOPLA), Broken Authentication, Excessive Data Exposure, and Security Misconfiguration. It highlights shifts in the OWASP framework, provides examples like the T-Mobile breach and the Peloton API flaw, and offers remediation advice including server-side permission checks, allowlisting fields, and proper configuration management. |
| 2026-04-10 2026 | OWASP Top 10 2025: What's Changed and Why beginner 9 min read | Library summarizing the OWASP Top 10 2025 list, detailing the significant changes from the 2021 edition. It highlights two new categories: Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10). The entry also notes shifts in existing categories, with Security Misconfiguration rising to #2, Server-Side Request Forgery (SSRF) consolidated into Broken Access Control (A01), Cryptographic Failures dropping to #4, Injection to #5, and Insecure Design to #6. This resource reflects an updated understanding of modern attack vectors, encompassing a broader analysis of CVEs and community insights. |
| 2026-04-10 2026 | Top 10 OWASP API Security in 2026 beginner 6 min read | Reference detailing the OWASP API Security Top 10 risks for 2025, including Broken Object Level Authorization (BOLA), Broken Authentication, Unrestricted Resource Consumption, Broken Function Level Authorization, Server Side Request Forgery (SSRF), and Security Misconfiguration, with strategies for mitigation and prevention. |
| 2026-04-10 2026 | OWASP Top Ten 2025: Key Security Risks for APIs beginner | OWASP Top Ten 2025: Key Security Risks for APIs |
| 2026-04-10 2026 | OWASP API Security: Top 10 Risks & Remedies for 2026 beginner 18 min read | Reference discussing OWASP's Top 10 API Security Risks, highlighting evolving threats particularly due to AI integration and agentic applications. It details vulnerabilities such as third-party API exploitation, forgotten and shadow APIs, and security misconfigurations in API management solutions. Recommendations include implementing rigorous input validation, API inventory, secure communication channels, and automated security testing, with mentions of Axway's Amplify Platform for API cataloging and management. |
| 2026-04-06 2026 | Protecting Payment, Cart, and Login Endpoints at the Edge intermediate 7 min read | Library for edge-based API security that protects critical e-commerce endpoints like payment, cart, and login from OWASP API Security Top 10 attacks. It utilizes API schema definition and real-time request validation at the network edge to block threats such as Broken Object Level Authorization, Broken Authentication, and Injection attacks without introducing latency or requiring manual rule management. |
| 2026-04-06 2026 | Open Banking API Security: The Complete Guide in 2026 beginner | Open Banking API Security: The Complete Guide in 2026 |
| 2026-04-06 2026 | Enhancing REST API Fuzzing with Access Policy Violation Detection intermediate 66 min read Fuzzing | Library extension for EvoMaster that adds novel automated oracles to detect access policy violations, specifically Broken Object Level Authorization (BOLA) and Broken Function Level Authorization (BFLA), alongside traditional SQL Injection and XSS attacks. This approach integrates seamlessly into existing REST API fuzzing workflows, enabling the generation of executable test cases in multiple programming languages to identify security issues missed by other methods. → arxiv.org |
| 2026-04-06 2026 | 6 Ways to Protect Your Spring Boot APIs from Common Attacks intermediate | 6 Ways to Protect Your Spring Boot APIs from Common Attacks |
| 2026-04-03 2026 | API management: Fundamentals for cloud security teams beginner 9 min read | Library for API management, a crucial component of cloud security, offering standardized authentication and policy enforcement via edge gateways. It enhances API security by combining agentless cloud scanning with API discovery, mapping APIs to cloud resources and data sensitivity. This approach reduces incident response times, minimizes audit findings, and enables zero trust architectures by addressing vulnerabilities like broken object-level authorization, broken authentication, and shadow APIs. Key capabilities include gateway traffic management, centralized authentication/authorization, and comprehensive monitoring and observability. → wiz.io |
| 2026-04-03 2026 | InQL - GraphQL Scanner | PortSwigger BApp Store intermediate 2 min read | Library for GraphQL security testing that simplifies vulnerability identification through schema analysis, query generation, and custom scanning. It auto-generates queries, mutations, and subscriptions, with features like circular reference detection and batch query support for rate limit bypasses and DoS vectors. Results integrate with Burp Repeater and Intruder, and schemas can be visualized with GraphiQL or GraphQL Voyager. → portswigger.net |
| 2026-04-03 2026 | OWASP API Security Top 10 Explained | Salt Security beginner | OWASP API Security Top 10 Explained | Salt Security |
| 2026-04-03 2026 | How To Prepare For An API Penetration Test beginner 12 min read | Guide for preparing API penetration tests, detailing common vulnerabilities and the importance of scope definition. It advises providing documentation, Postman collections, and Swagger files to testers for grey-box or source code-assisted assessments, and outlines the use of tools like Postman and Swagger UI in the testing process. |
| 2026-04-03 2026 | Awesome GraphQL Security - Curated List of Resources beginner 4 min read GraphQL | Library of curated resources for GraphQL security, encompassing frameworks like GraphQL Shield and GraphQL Armor, testing tools such as Escape, GraphCrawler, and InQL, and educational materials covering vulnerabilities like aliasing attacks, CSRF, cyclic queries, and IDOR. It also lists clients like Postman and Insomnia, and schema visualization tools like Voyager. |
| 2026-04-03 2026 | API Testing with Burp Suite: A Practical Guide intermediate 7 min read | Library for intercepting, modifying, and analyzing API traffic with Burp Suite, detailing techniques for REST APIs like parameter tampering and SQL injection detection in Repeater, and for GraphQL APIs, including schema introspection queries and modifying requests via dedicated GraphQL tabs. The library also highlights Burp Intruder for fuzzing and Pynt as an alternative tool. |
| 2026-04-03 2026 | Top 6 API Pentesting Tools | Cobalt beginner 6 min read | Library of top API penetration testing tools including Postman for managing requests and proxied through tools like Burp Suite for in-depth analysis, vulnerability discovery via Repeater and Intruder, and automated scanning. Swagger aids testers by providing standardized API documentation, while SoapUI assists with SOAP-based APIs. GraphQL, a query language, presents unique challenges requiring schema understanding and targeted query crafting for vulnerabilities like DoS and authorization bypasses. ZAP, an OWASP DAST tool, offers proxying, scanning for vulnerabilities like XSS and SQL injection, and supports formats like JSON and XML, with add-ons for OpenAPI, GraphQL, and SOAP. → cobalt.io |
| 2026-04-03 2026 | GraphQL API Vulnerabilities | Web Security Academy intermediate 11 min read GraphQL | Reference detailing GraphQL API vulnerabilities, focusing on implementation and design flaws like exposed introspection. It covers finding GraphQL endpoints, identifying vulnerabilities through universal queries and unsanitized arguments (leading to issues like IDOR), and leveraging introspection queries to map schema information. The reference highlights how Burp Suite can assist in discovering endpoints and introspection, and discusses best practices for securing GraphQL APIs. → portswigger.net |
| 2026-04-03 2026 | API Testing | Web Security Academy beginner 8 min read | Library for testing RESTful and JSON APIs, covering techniques to identify endpoints, analyze API documentation, and interact with identified resources using tools like Burp Suite. It details how to discover hidden endpoints and parameters by manipulating HTTP methods and content types, and how to leverage machine-readable documentation such as OpenAPI specifications. This resource also maps common web vulnerabilities to their API equivalents, referencing the OWASP API Security Top 10. → portswigger.net |
| 2026-04-03 2026 | OWASP API Security Top 10 beginner 1 min read | Project that provides awareness and mitigation strategies for common API security risks. It aims to document the Top 10 API Security Risks, offer best practices for secure API development, and foster community collaboration for evolving security trends. The resources are licensed under Creative Commons. → owasp.org |
| 2026-04-03 2026 | OWASP API Security Project | OWASP Foundation beginner 5 min read | Project detailing API security strategies and solutions, focusing on mitigating unique vulnerabilities. It highlights the API Security Top 10 2023 list, including Object Level Access Control issues, faulty authentication, excessive data exposure, denial of service, authorization flaws, business logic abuse, Server-Side Request Forgery (SSRF), insecure configurations, lack of proper documentation, and reliance on third-party APIs. The project is licensed under Creative Commons Attribution-ShareAlike 4.0 and is freely available, with contributions maintained on GitHub. → owasp.org |
| 2026-02-06 2026 | SOAPwnwatchtowr soappwn research whitepaper advanced | SOAPwnwatchtowr soappwn research whitepaper |
| 2026-01-19 2026 | Hackmanit/Web-Cache-Vulnerability-Scanner: Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/). beginner 5 min read | Library for testing web cache poisoning and deception. It supports ten cache poisoning techniques, including unkeyed header poisoning and HTTP response splitting, and multiple cache deception techniques like path traversal. The tool features an adaptive crawler, customizable options for headers, cookies, and parameters, and can generate JSON reports. WCVS can be integrated into CI/CD pipelines and is available as pre-built binaries or via Go installation. |
| 2026-01-17 2026 | pwviptbl/ProxyHunter: Aplicação Python com interface gráfica que permite configurar regras de interceptação para modificar parâmetros de requisições HTTP. Quando o navegador envia uma requisição para uma rota configurada, o proxy intercepta, modifica apenas os parâmetros especificados e encaminha a requisição mantendo todos os outros parâmetros originais. intermediate 12 min read Burp Python | Tool that intercepts HTTP requests, modifies specific parameters based on configurable rules, and forwards them. It features a graphical interface, WebSocket support, an advanced Intruder for automated attacks, and scanners for SQL Injection, XSS, CSRF, Path Traversal, and more. Additional functionalities include a passive and active scanner, spider/crawler, request comparator, and CLI management. |
| 2026-01-07 2026 | GitHub - pranav-cs-1/nexus: A terminal-based HTTP client for API testing intermediate 2 min read | Tool for terminal-based API testing, Nexus streamlines request management with a keyboard-driven interface and persistent storage via the sled embedded database. It supports full HTTP method functionality, request organization into collections, response viewing with status codes and headers, and complete request editing. Nexus can import Postman Collections (v2.1) with support for authentication and nested folders, and export collections as JSON or individual requests as curl commands. |
| 2025-12-30 2025 | Teycir/BurpAPISecuritySuite: Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance. Supports REST/GraphQL/SOAP APIs with Nuclei, Turbo Intruder, and external tool integration. OWASP API Top 10 coverage. intermediate 38 min read Burp Fuzzing GraphQL | Library for comprehensive API security testing within Burp Suite. This extension consolidates 15 attack types, over 108 payloads, and integrates external tools like Nuclei, Turbo Intruder, and ApiHunter. It features intelligent fuzzing, automated reconnaissance, and detection of vulnerabilities such as BOLA and IDOR, with support for REST, GraphQL, and SOAP APIs, covering OWASP API Top 10 and offering AI integration for payload generation. |
| 2025-11-27 2025 | How Hackers Are Exploiting Salesforce and Why Architects Must Act | Salesforce Ben news 9 min read | Analysis of Salesforce security exploits highlights a critical knowledge gap between security and Salesforce teams. Hackers exploit undocumented features like public links, Chatter groups, and Lightning APIs, as well as content ingestion and third-party risks such as phishing links and malicious images, which native Salesforce tooling and audits often miss. The article emphasizes the need for individuals with hybrid skillsets to bridge this divide and properly architect secure, usable Salesforce organizations, noting that expensive native tools like Event Monitoring and Data Detect require additional implementation and expertise to be effective. |
| 2025-10-19 2025 | GitHub - fosrl/pangolin: Identity-Aware Tunneled Reverse Proxy Server with Dashboard UI intermediate 2 min read | Library implementing an identity-aware tunneled reverse proxy server with a dashboard UI. Pangolin enables secure remote access to private and public resources via browser-based or client-based connections, combining reverse proxy and VPN capabilities. It facilitates access through restrictive firewalls using outbound tunnels and NAT traversal, offering granular access controls, role-based access control (RBAC) via integrated users or external identity providers, and supports automatic SSL certificates and load balancing, adhering to a zero-trust model. |