The newest API Security resources are on the API Security page. For a reading order instead of a date order, see the API Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-10-05 2025 | API Hacking - Just Hacking Training (JHT) beginner 1 min read Bug Bounty | Workshop slides from DEF CON 32 covering hardware fault injection on specific targets. |
| 2025-08-14 2025 | Detect SSRF Attacks in Cloud Applications and APIs | Datadog intermediate 3 min read SSRF | Library for detecting server-side request forgery (SSRF) attacks against cloud applications and APIs. It highlights prevalent vulnerabilities in Java services, like those in Jackson and Apache libraries, and details how attackers exploit them to access cloud metadata services and credentials. The library aids in identifying malicious traffic by monitoring API response timing and patterns, such as requests to sensitive domains like metadata.google.internal or malformed URLs. It integrates with Datadog Application and API Protection (AAP) for automated detection and blocking via its WAF. |
| 2025-08-06 2025 | ByteByteGo | How does HTTPS work? beginner 1 min read | Guide detailing HTTPS functionality, explaining its role in securing internet communication through Transport Layer Security (TLS). It breaks down the handshake process, including TCP connection establishment, client and server hellos, SSL certificate validation, and the secure exchange of a session key using asymmetric and symmetric encryption to protect data from interception. |
| 2025-05-07 2025 | Using JWTs in Python Flask REST Framework | AppSignal Blog intermediate 8 min read AuthN Python | Library for implementing JWT-based authentication in Python Flask REST Framework applications. This resource details the structure of JWTs (header, payload, signature), their benefits like stateless sessions and security, and demonstrates their practical application. It covers setting up a Flask environment, creating user registration and login endpoints that issue JWTs using Flask-JWT-Extended, securing API routes with `@jwt_required()`, and managing task creation, retrieval, updates, and deletion for authenticated users. The guide also explains how to implement token refreshes for longer-lived sessions. |
| 2025-03-01 2025 | CORS Finally Explained — Simply - Level Up Coding beginner | There are millions of articles explaining how to fix the error above, but what exactly is this “Cross-Origin Resource Sharing” (CORS) thing, and why does it even exist? Let's begin by first answering… → levelup.gitconnected.com |
| 2025-02-10 2025 | GitHub - usebruno/bruno: Opensource IDE For Exploring and Testing Api's (lightweight alternative to postman/insomnia) intermediate 2 min read | Library for API exploration and testing, Bruno offers a privacy-focused, offline-first alternative to Postman and Insomnia. It stores API collections in local filesystem folders using the Bru markup language, facilitating collaboration via Git or other version control systems. Bruno is available for Mac, Windows, and Linux, with installation options including binary downloads and package managers like Homebrew, Chocolatey, Scoop, Snap, Flatpak, and Apt. |
| 2025-02-10 2025 | GitHub - samwafgo/SamWaf: SamWaf开源轻量级网站防火墙，完全私有化部署 SamWaf is a lightweight, open-source web application firewall for small companies, studios, and personal websites. It supports fully private deployment, encrypts data stored locally, is easy to start, and supports Linux and Windows 64-bit. beginner 1 min read | Library for lightweight, open-source web application security, SamWaf offers fully private deployment with encrypted local data storage. It supports custom rule creation, IP and URL blacklisting, CC frequency limiting, and OWASP CRS rule sets. SamWaf is designed for small companies and personal websites, easily deployable on Linux and Windows, and includes features like automatic SSL certificate management and IPv6 support. |
| 2025-01-28 2025 | GitHub - traefik/whoami: Tiny Go server that prints os information and HTTP request to output beginner 2 min read | Tool is a tiny Go webserver that prints OS information, HTTP request details, environment variables, and network information. It supports custom wait times via the `wait` query parameter, allows modification of GET response status codes with POST requests to `/health`, and can serve HTTPS with provided certificates. The tool also features WebSocket echo, health checks, and can be configured to listen on different ports. It can be used to test network configurations, debug HTTP requests, and integrate with containerized environments. |
| 2025-01-22 2025 | GitHub - c0dejump/HExHTTP: Header Exploitation HTTP intermediate 4 min read | Tool for testing HTTP headers to identify vulnerabilities such as web cache poisoning and Cache Poisoning DoS (CPDoS). HExHTTP supports flexible proxy configuration, integration with Burp Suite for issue reporting, and human-like request behavior to bypass WAFs. It analyzes various header types, including hop-by-hop headers, and tests CDN/proxy responses. |
| 2025-01-20 2025 | GitHub - chaitin/SafeLine: SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits. beginner 2 min read | Library for a self-hosted Web Application Firewall (WAF) and reverse proxy, SafeLine protects web applications from attacks including SQL injection, XSS, code injection, OS command injection, CRLF injection, XXE, SSRF, path traversal, bruteforce, and HTTP floods. It offers proactive bot defense, HTML/JS code encryption, IP-based rate limiting, and web access control lists, defending against DoS attacks and traffic surges. SafeLine implements anti-bot and authentication challenges, with dynamic protection that encrypts code on each visit. |
| 2024-12-22 2024 | GitHub - fabriziosalmi/patterns: Automated OWASP CRS and Bad Bot Detection for Caddy, Nginx, Apache, Traefik and HaProxy intermediate 4 min read | Library automates OWASP CRS and bad bot detection for Caddy, Nginx, Apache, Traefik, and HAProxy. It scrapes OWASP Core Rule Set patterns daily, converting them into WAF configurations for various web servers to defend against SQL Injection, XSS, RCE, and LFI. Additionally, it integrates bad bot blocking using public lists to thwart malicious crawlers and scrapers, offering pre-generated configurations and automated updates via GitHub Actions. |
| 2024-12-20 2024 | GitHub - xnl-h4ck3r/knoxnl: This is a python wrapper around the amazing KNOXSS API by Brute Logic intermediate 8 min read Python | Library for Python that wraps the KNOXSS API, enabling automated scanning for Cross-Site Scripting (XSS) and Open Redirect vulnerabilities. It supports various input methods, including single URLs and files, and allows for detailed configuration, including Discord webhook notifications, API key management, and Flash Mode for quick tests. The library also integrates with Burp Suite via the Piper extension for proxy-based testing, handling both GET and POST requests with optional headers and post data. |
| 2024-12-14 2024 | postMessage Braindump intermediate 2 min read | Writeup on postMessage security vulnerabilities, detailing how to identify and exploit them. It highlights `postMessage` as a cross-origin communication mechanism akin to an API, discoverable via Frans Rosen's postMessage Tracker and browser DevTools. The writeup explains debugging techniques using breakpoints to trace `postMessage` execution paths, demonstrating an XSS vulnerability achieved by setting event attributes via malicious `postMessage` payloads. It also warns about common regex errors when validating `event.origin` for securing `postMessage` listeners. |
| 2024-12-13 2024 | Server SSL certificate verification - HTTPie 3.2.4 (latest) docs beginner 39 min read | Library for interacting with HTTP services from the command line, designed for human-friendly testing and debugging. It supports intuitive syntax, formatted output, JSON, forms, uploads, HTTPS, proxies, authentication, custom headers, persistent sessions, downloads, and a plugin system. Installation instructions are provided for various package managers and operating systems, including standalone executables. The documentation details usage for custom methods, headers, JSON data, form submissions, offline requests, authentication, file uploads/downloads, sessions, and URL parameters. |
| 2024-12-12 2024 | API Testing with Insomnia and Burp Suite: An Alternative to Postman intermediate 8 min read Burp | Library for API testing using Insomnia and Burp Suite, offering an alternative to Postman. This resource details capturing API requests with mitmproxy, converting them to OpenAPI 3.0 format using mitmproxy2swagger, and importing into Insomnia. It covers Insomnia's variable management, integration with Burp Suite for request interception and modification, and testing for outdated API versions. |
| 2024-12-03 2024 | Hacking API discovery with a custom Burp extension intermediate 8 min read Burp | Library for enhanced API discovery within Burp Suite, employing a brute-force methodology to locate API documentation artifacts. It dynamically generates a wordlist exceeding 4,000 combinations, combining various prefix directories, doc endpoints, UI endpoints, and extensions. The library also implements resilient request handling with exponential backoff and adjusted connection timeouts, alongside parallel processing for increased efficiency. → danaepp.com |
| 2024-11-28 2024 | GitHub - cc1a2b/jshunter: JShunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for developers and security researchers. intermediate 8 min read | Tool for analyzing JavaScript files, JSHunter extracts endpoints, identifies sensitive data like API keys and JWT tokens, and detects vulnerabilities. It supports comprehensive endpoint discovery, advanced code analysis, multiple input methods, and high-performance processing with stealth features such as proxy support and user-agent rotation. Features include deobfuscation, source map parsing, GraphQL analysis, and WAF bypass detection, with professional output formats like JSON and CSV, and direct integration with Burp Suite. |
| 2024-11-26 2024 | The OAuth Oversight: When Configuration Errors Turn into Account Hijacks intermediate AuthN | Hey folks I hope you are doing well. I am back with another writeup on OAuth misconfiguration leads to account takeover. The PoC is… |
| 2024-11-05 2024 | What is Azure Web Application Firewall on Azure Front Door? beginner 7 min read | Library for Azure Web Application Firewall on Azure Front Door, offering centralized protection against web exploits and vulnerabilities. It inspects incoming requests globally at network edge locations, preventing attacks before they reach your virtual network. Features include custom rules for IP allow/block lists, geographic access control, HTTP parameter matching, rate limiting, and Azure-managed rule sets for SQL injection, cross-site scripting, and more. WAF policies can operate in detection or prevention modes, with actions like ALLOW, BLOCK, LOG, and REDIRECT. |
| 2024-11-05 2024 | HTTP Security Headers: A complete guide to HTTP headers beginner 21 min read | Reference on HTTP security headers detailing their functions in protecting against vulnerabilities like Cross-Site Scripting (XSS) and Clickjacking. It explains key headers such as Access-Control-Allow-Origin for CORS, Content-Type for data interpretation, and Content-Security-Policy (CSP) for controlling resource loading and execution. The guide emphasizes the importance of properly configuring these headers to enhance web application security. |
| 2024-10-03 2024 | Automate your API hacking with Autorize intermediate 6 min read AuthN AuthZ | Library for automating API security testing, Autorize is a Burp Suite extension that detects broken object level authorization (BOLA) by repeatedly sending requests with different user privileges. It analyzes response changes to identify authorization and authentication issues, supporting active scans and offering configuration for interception filters and enforcement detectors. Autorize can be integrated with Repeater and customized to filter results for potential bypasses and 401 status codes, aiding in the discovery of vulnerabilities like unauthorized access to administrative functions. → danaepp.com |
| 2024-10-01 2024 | Exploiting trust: Weaponizing permissive CORS configurations advanced 15 min read | Writeup on exploiting permissive CORS configurations, detailing how misconfigurations can lead to severe vulnerabilities. It explains the same-origin policy and how Cross-Origin Resource Sharing (CORS) relaxes it. The writeup highlights common mistakes like reflecting the "Origin" header without validation, trusting the "null" origin, and flawed subdomain validation in trusted origins. Case studies, including those from a bank and a travel booking application, demonstrate how these weaknesses can be weaponized to steal API keys, session tokens, and achieve account takeovers through techniques like those discovered using Burp Suite's CORS scan check. |
| 2024-09-23 2024 | Sec_Mind_Maps/OWASP API TOP 10.pdf at main · h0tak88r/Sec_Mind_Maps beginner | cyber security mind maps collection. Contribute to h0tak88r/Sec_Mind_Maps development by creating an account on GitHub. |
| 2024-09-21 2024 | Proving API exploitability with Burp Collaborator intermediate 5 min read Burp | Tool for proving API exploitability using Burp Collaborator, an out-of-band application security testing (OAST) feature. This method allows demonstration of vulnerabilities like RCE, SSRF, and blind XXE by capturing interactions with mock network services (DNS, HTTP, SMTP) without needing to establish reverse shells. Examples include its use in testing CVE-2023-4044, an insecure deserialization flaw in WS_FTP, and against crAPI for blind SSRF detection. Users can leverage hosted services or set up private Burp Collaborator servers. → danaepp.com |
| 2024-09-16 2024 | Automating the CORS Vulnerability Scan intermediate AuthZ Bug Bounty | When conducting a bug bounty, automating your scanning process not only saves time but ensures you don’t miss common vulnerabilities. One… |
| 2024-09-14 2024 | Unlocking OAuth Security intermediate AuthN | In this blog, we will uncover the different oauth security implications on both the client applications and the oauth server. → infosecwriteups.com |
| 2024-09-05 2024 | JWT vs PASETO: New Era of Token-Based Authentication beginner AuthN JWT | This article delves into a comprehensive comparison of Paseto and JWT, dissecting their core functionalities, security features, and… |
| 2024-08-16 2024 | Securing OAuth 2.0 Token Exchange Flow with Keycloak intermediate AuthN JWT | RFC 8693: Token Exchange describes a mechanism for exchanging an existing token (JWT) for a new token with different issuing client id… |
| 2024-08-12 2024 | GitHub - Brum3ns/firefly: Black box fuzzer for web applications beginner 3 min read Fuzzing | Library for black-box web application fuzzing, Firefly utilizes goroutines for high performance and an inductive engine to analyze responses. It offers customizable payloads, tampering, encoding, and detailed filtering options for request verification and result refinement. Firefly supports various input methods including raw HTTP requests and integrates with tools like `jq` for advanced result analysis. |
| 2024-08-03 2024 | Beyond the Limit: Expanding single-packet race condition with a first sequence sync for breaking the 65,535 byte limit advanced 10 min read Fuzzing | Technique for expanding single-packet race conditions by overcoming the 1,500-byte request limit. This method leverages IP fragmentation to split large TCP packets across multiple IP packets, allowing for the full utilization of the TCP window size, up to 65,535 bytes. It then employs TCP sequence number reordering, specifically a "First Sequence Sync," to delay server packet processing until the final packet with the initial sequence number is received, enabling the synchronization and simultaneous processing of numerous large requests. |
| 2024-07-30 2024 | OAuth+XSS Attack Threatens Millions of Web Users With Account Takeover beginner AuthN XSS | An attack flow that combines API flaws within "log in with" implementations and Web injection bugs could affect millions of websites. → darkreading.com |
| 2023-10-12 2023 | Web AppSec Interview Questions beginner 16 min read Bug Bounty | Reference for web application security interview questions, this resource delves into topics such as Web Cache Deception vs. Poisoning, Session Fixation exploitation, Base64 vs. Base64URL, various XSS types, Blind SQL Injection, Same-Origin Policy, HTTP Request Smuggling (TE.TE variant), DOM Clobbering, HTTP Parameter Pollution, IDOR, JWKs/JKUs, Business Logic vulnerabilities, Server-Side Template Injection payloads, Sec-WebSocket-Key header, CSP's "unsafe-inline", stateless authentication weaknesses, CSRF mitigation techniques, XML parameter entities in XXE, DOM-based XSS fixes, CORS Preflight request prevention, Insecure Deserialization exploitation, secure file upload practices, Mass Assignment, GraphQL batching for rate limiting bypass, type juggling with JSON, sensitive data exposure techniques, and CSRF immune requests. |
| 2023-10-09 2023 | What is OAuth (The Modern Guide) beginner 69 min read AuthN | Guide to OAuth 2.0 detailing eight common real-world modes: local login/registration, third-party/first-party/enterprise login/registration (federated identity), third-party/first-party service authorization, machine-to-machine authentication/authorization, and device login/registration. It clarifies the distinction between OAuth and SAML, explaining OAuth as an authorization system with authentication layered on top, contrasting it with SAML's primary authentication focus. The guide helps developers choose the appropriate OAuth mode based on specific use cases, such as outsourcing authentication, avoiding credential storage, or enabling service-to-service communication. |
| 2023-09-03 2023 | ffuf advanced tricks - ACCEIS intermediate 14 min read Fuzzing | Library for advanced `ffuf` techniques, focusing on fuzzing capabilities beyond simple directory enumeration. This resource details using configuration files for persistent settings like colorization, custom headers (e.g., `X-SOC-Tag`), and proxy integration. It also covers reading from standard input, employing external payload mutators like Radamsa, and avoiding false negatives with advanced filtering. The content assumes familiarity with basic `ffuf` usage, including fuzzing parameters and identifying virtual hosts. |
| 2023-09-02 2023 | Web AppSec Interview Questions beginner 16 min read | Reference of web application security interview questions and answers covering topics like Web Cache Poisoning, Session Fixation, SQL Injection variants (Boolean Error Inferential), DOM Clobbering, HTTP Request Smuggling (TE.TE), Cross-Site Scripting (XSS), HTTP Parameter Pollution, Insecure Deserialization, Mass Assignment, GraphQL batching, type juggling, and Cross-Site Request Forgery (CSRF) mitigation techniques. |
| 2023-08-30 2023 | NosyMonkey: API hooking and code injection made easy! advanced 12 min read Mobile | Library for API hooking and code injection, NosyMonkey simplifies complex tasks for security researchers. It automates the process of making compiled binaries perform unintended actions or alter their behavior without requiring source code modification. NosyMonkey handles the intricate details of creating DLLs, injecting code, and establishing hooks, allowing researchers to easily modify API calls, conceal processes from tools like Task Manager, or dump sensitive information like LSASS credentials, as demonstrated in examples involving API microservicing and direct system calling. |
| 2023-08-22 2023 | (Research) Exploiting HTTP Parsers Inconsistencies advanced Bug Bounty | (Research) Exploiting HTTP Parsers Inconsistencies https://ift.tt/EfMHcVm |
| 2023-07-26 2023 | Web Application Black-Box testing intermediate Bug Bounty Recon | Web Application Black-Box testing https://ift.tt/d1Mrqn4 |
| 2023-07-19 2023 | Web App Hacking with Caido.io intermediate Burp | Web App Hacking with Caido.io https://www.youtube.com/watch?v=lW-u_2EByT4 |
| 2023-06-15 2023 | DetectCrossOriginMessaging intermediate 1 min read | Library for detecting cross-origin messaging vulnerabilities, specifically those stemming from insecure use of `postMessage` in JavaScript. It helps identify tainted data sources and common sinks like `document.write` and `element.innerHTML`, as well as common origin validation bypasses involving unescaped dots or incomplete regex patterns. This Burp extension aids in investigating `postMessage` implementations to prevent DOM XSS and information leaks. |
| 2023-06-14 2023 | hisxo/JSpector beginner | Extension for Burp Suite, JSpector passively crawls JavaScript files, identifying URLs, endpoints, and dangerous methods. Upon successful loading (requiring Jython), it automatically generates issues in the Dashboard tab, allowing for export of discovered information to the clipboard. |
| 2023-05-27 2023 | open-appsec ML-based WAF protects against modern SQLi AutoSpear evasion techniques news 5 min read SQLi | Library that uses machine learning to defend against advanced SQL injection evasion techniques, including those demonstrated by the AutoSpear project. It focuses on identifying "non-legitimate" payloads rather than classifying specific attack types, allowing it to block zero-day attacks and bypasses involving complex encoding, case swapping, whitespace substitution, and DML substitution without requiring constant rule updates. |
| 2023-04-13 2023 | OWASP Proactive Controls 2023/2024 v1 beginner AuthN AuthZ | OWASP Proactive Controls 2023/2024 v1 https://ift.tt/xVAnFY5 → docs.google.com |
| 2023-04-13 2023 | WebSockets are a Pain - A Journey in Learning and Leveraging intermediate 7 min read | Library detailing WebSocket communication, its advantages for attackers like real-time data transfer and bypassing proxies, and its handshake process. The entry includes practical applications for Command and Control (C2) infrastructure using tools like Caddy, PowerShell, and native Linux tooling such as websocat, demonstrating how to leverage WebSockets for covert communication and data exfiltration. → blog.zsec.uk |
| 2023-04-10 2023 | How to Implement OAuth 2.0 Login for Python Flask Web Server Applications intermediate 4 min read AuthN Python | Tutorial on implementing OAuth 2.0 login for Python Flask web server applications. This guide details enabling Google APIs, creating OAuth client IDs, securely storing credentials, and writing Python code for the login flow. It covers redirect URIs, environment variables, and front-end HTML templates, with complete code available on GitHub. |
| 2023-04-08 2023 | vfaronov/httpolice: Validator for HTTP beginner | Library for validating HTTP requests and responses, HTTPolice identifies syntax errors in headers, incorrect status codes, and other common issues. It functions as a command-line tool capable of parsing HAR files and raw HTTP/1.x TCP streams, integrating with mitmproxy for TLS and HTTP/2 traffic, or serving as a Python library. Integrations include a Django package and a Chrome extension. HTTPolice was inspired by REDbot but focuses on analyzing provided traffic rather than active testing. |
| 2023-04-05 2023 | OAuth 2.0 beginner 4 min read AuthN | Library for implementing OAuth 2.0 authorization flow, specifically for the Google APIs Client Library for Python. It guides users on acquiring client IDs and secrets, managing browser redirects with `Flow` classes like `InstalledAppFlow`, and exchanging authorization codes for `Credentials` objects. The library supports both end-user authorization and service account authentication, deprecating the older `oauth2client` library in favor of `google-auth` and `google-auth-oauthlib`. |
| 2022-06-09 2022 | Favorite tweet by @fardeenahmed411 beginner Bug Bounty | Favorite tweet: API Bug-Bounty Tools Check list (Part - 1) - Postman (It is like Burpsuite for API) - APISec - AppKnox - Synopsis API Scanner - Data Theorem API Secure #cybersecuritytips #bugbountyti... |
| 2022-03-23 2022 | Favorite tweet by @imranparray101 news Bug Bounty | Favorite tweet: We at @snap_sec recently published a bunch of articles on “Attacking modern web apps” , go check them out. 👇 https://t.co/dwzeO7cGl2 https://t.co/8bpZX25CTL https://t.co/WHT1rreRro ht... |
| 2022-01-08 2022 | Damn Vulnerable GraphQL Application beginner 2 min read GraphQL | Library for practicing GraphQL security, Damn Vulnerable GraphQL Application (DVGA) is an intentionally insecure implementation featuring numerous flaws including injections, code execution, authorization bypasses, denial of service, and SSRF. It offers beginner and expert modes, covering scenarios like GraphQL introspection, batch query attacks, and OS command injection, with a provided Postman collection for challenge solutions. |