The newest API Security resources are on the API Security page. For a reading order instead of a date order, see the API Security learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2022-01-06 2022 | awesome-apisec beginner 2 min read | Library of open-source API security tools and resources, curated for community benefit. It categorizes offerings into areas like API keys, enumeration, fuzzing, firewalls, and design, along with books, cheat sheets, and presentations. The repository emphasizes community contributions and avoids vendor-specific, commercial, or closed-source materials, focusing strictly on relevance to API security, bug hunting, hardening, and hacking. |
| 2021-12-15 2021 | REST Resources Provided By: Bitbucket Server - REST beginner 133 min read | Reference for Bitbucket Server's REST API, detailing how to access resources via URIs, utilize HTTP methods like GET and POST, and handle JSON responses. It explains paging mechanisms, authentication methods (HTTP Basic, OAuth, Cookies, Trusted Applications), and common error responses including 40x client errors and 500 server errors. The reference covers accessing personal repositories through both project-centric and user-centric URLs, and includes specific examples for clearing CAPTCHAs and deleting groups. |
| 2021-11-26 2021 | Phantom - A multi-platform HTTP(S) Reverse Shell Server and Client intermediate 3 min read RCE | Library for building multi-platform HTTP(S) reverse shells, Phantom provides a server and client implemented in Python 3. It facilitates encrypted communication via HTTPS by supporting auto-generated or user-supplied certificates and includes a helper script for generating self-signed certificates. Binaries for Linux and Windows can be built using PyInstaller, with client binaries containing hardcoded server URLs for stealthy connections. Phantom supports dependency management via Poetry or Virtualenv. |
| 2021-11-23 2021 | Hacking OAuth Applications intermediate 3 min read AuthN | Talk from DEF CON 31 detailing how to hack OAuth applications. It covers vulnerabilities like impersonation by manipulating access tokens and state parameters, authorization code theft via manipulated redirect URIs, and bypassing validation with localhost URIs or duplicate parameters. The talk also discusses stealing implicit grant tokens, exploiting registration flaws for account takeovers, and leaking tokens via Host header injection. |
| 2021-11-13 2021 | Web Attack Cheat Sheet beginner 61 min read Bug Bounty SQLi XSS | Cheatsheet detailing web attack techniques, including discovery, enumeration, scanning, monitoring, manual payloads, bypasses, and specific vulnerabilities like SSRF, XXE, OAuth, DNS Rebinding, HTTP/SMTP Header Injection, Web Shells, Reverse Shells, SQLi, XSS, XPath Injection, Path Traversal, LFI, SSTI, Information Disclosure, and WebDAV. It also references tools and data sources for reconnaissance, CDN IP range identification, origin IP discovery, and subdomain enumeration. |
| 2021-11-12 2021 | Advanced request smuggling advanced 8 min read SSRF | Library detailing advanced HTTP request smuggling techniques, building on fundamental concepts to explore potent HTTP/2 vectors. It covers how common HTTP/2 implementations, including H2.CL and H2.TE vulnerabilities stemming from HTTP/2 downgrading, enable new attack opportunities. The library also addresses response queue poisoning, persistent response cache poisoning for site takeover, and constructing high-severity exploits even without connection reuse, with examples referencing Black Hat USA 2021 research. → portswigger.net |
| 2021-11-10 2021 | Practical HTTP Header Smuggling: Sneaking Past Reverse Proxies to Attack AWS and Beyond intermediate 14 min read | Library for practical HTTP header smuggling, a technique that hides request headers from some servers in a chain while others see them. This method identifies header smuggling by comparing server responses to mutated headers versus regular ones, demonstrating its effectiveness in bypassing AWS API Gateway IP restrictions and AWS Cognito rate limiting. The research also details how header smuggling can lead to exploitable cache poisoning, and presents a black-box methodology for detecting CL.CL request smuggling vulnerabilities. |
| 2021-11-01 2021 | MalAPI.io beginner | MalAPI.io |
| 2021-10-26 2021 | How to set up Docker for Varnish HTTP/2 request smuggling intermediate 3 min read | Walkthrough of setting up a Docker environment to test HTTP/2 request smuggling, focusing on CVE-2021-36740. This technique exploits how H2-compatible proxies rewrite HTTP/2 requests to HTTP/1.1, specifically when Varnish cache improperly handles the `Content-Length` header during this conversion, allowing malicious requests to be prepended to subsequent legitimate ones. The setup involves Varnish, Hitch for TLS termination, and origin servers. → labs.detectify.com |
| 2021-10-25 2021 | HTTP Headers beginner 12 min read | Cheatsheet detailing security-focused HTTP headers like X-Frame-Options, Content Security Policy (CSP) frame-ancestors, X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security (HSTS), and recommendations for their configuration to prevent vulnerabilities such as Cross-Site Scripting and Clickjacking. It also covers other headers including X-XSS-Protection, Content-Type, Cache-Control, Set-Cookie, and Access-Control-Allow-Origin, highlighting their roles in enhancing web application security. → cheatsheetseries.owasp.org |
| 2021-09-21 2021 | HTTPS Cheat Sheet beginner 4 min read | Cheatsheet for HTTPS configuration, detailing acceptable TLS protocols, cipher suite breakdown (key exchange, authentication, cipher, mode), and recommended Nginx/Apache directives. It covers HSTS, OCSP Stapling, and performance benefits like HTTP/2 and Brotli compression, with links to SSL Labs, securityheaders.io, Mozilla's config generator, and articles on HSTS and migration strategies. |
| 2021-09-15 2021 | HTTP Parameter Pollution intermediate | HTTP Parameter Pollution |
| 2021-09-06 2021 | Exploiting GraphQL intermediate 6 min read GraphQL | Tool BatchQL aids in exploiting GraphQL by identifying introspection query support, schema suggestions, and potential CSRF vulnerabilities. It performs batching attacks, including JSON list-based and query name-based methods, to bypass rate limiting and uncover sensitive mutations. The tool leverages techniques described in blog posts and integrates with external resources like Clairvoyance and the Altair Chrome Extension for schema recovery. |
| 2021-09-01 2021 | Shopify API versioning intermediate 3 min read | Reference for Shopify API versioning details its quarterly release schedule for stable API versions (e.g., 2026-04), which are supported for at least 12 months with nine months of overlap. It distinguishes between stable, release candidate, and unstable versions, and outlines deprecation processes for outdated or unsafe features, with potential delisting from the Shopify App Store for non-compliance. |
| 2021-08-30 2021 | api_wordlist beginner 1 min read Recon | Library of API function names for web application API fuzzing. Includes pre-compiled lists like `api_seen_in_wild.txt`, `actions.txt`, and `objects.txt`, alongside variations for case sensitivity. The resource details how to effectively use these lists within Burp Suite's Intruder, configuring it for "Cluster Bomb" attacks with "Runtime file" payloads to test API endpoints. |
| 2021-08-30 2021 | Cross-Site WebSocket Hijacking (CSWSH) intermediate XSS | Cross-Site WebSocket Hijacking (CSWSH) |
| 2021-08-25 2021 | Inside Figma: securing internal webapps intermediate 14 min read | Library for securely exposing internal web applications, detailing Figma's system built with AWS Application Load Balancers and Okta. It leverages SAML for authentication, AWS Cognito for identity management, and Terraform for infrastructure-as-code. The system emphasizes zero-trust principles, strong authentication via WebAuthn and MFA, centralized authorization using Okta Groups, and minimizes operational toil for the security team. |
| 2021-08-25 2021 | API Testing with HTTPie beginner Python | API Testing with HTTPie |
| 2021-08-21 2021 | API Security 101: Security Misconfiguration beginner | API Security 101: Security Misconfiguration |
| 2021-08-12 2021 | HTTP/2: The Sequel is Always Worse advanced 23 min read | Analysis of HTTP/2 vulnerabilities, including H2.CL and H2.TE request desynchronization attacks that target front-end servers downgrading HTTP/2 to HTTP/1.1. Case studies demonstrate exploitation against Amazon's Application Load Balancer and Netty, with one vulnerability leading to CVE-2021-2195 and maximum bug bounties by compromising Netflix accounts through JavaScript hijacking. Novel techniques and tooling for identifying and exploiting these widespread, overlooked request smuggling variants are also presented. → portswigger.net |
| 2021-07-22 2021 | HackerOne Hacker API tools beginner 1 min read | Library of Hacker API tools for bug bounty reconnaissance and reporting, including BBRF for workflow coordination, bbscope for scope gathering across platforms like HackerOne and Bugcrowd, Depcher for technology stack analysis and Vulners scans, and h1_2_nuclei for scanning programs with Nuclei. It also features tools like HackerBot for report notifications, h1scope for retrieving in-scope items, and reNgine for automated web application reconnaissance. |
| 2021-07-14 2021 | RequestBin Collect inspect and debug HTTP requests and webhooks beginner 1 min read Burp | Platform for inspecting and debugging HTTP requests and webhooks, offering cloud storage for persistent data access across devices, real-time request monitoring, and detailed analytics. It supports collaboration for distributed teams and remote development, built on SOC 2, GDPR, and CCPA compliant infrastructure, serving as a reliable service since 2018 for developers. |
| 2021-06-30 2021 | Web-Application-Pentest-Checklist beginner Bug Bounty Recon | This document is a comprehensive checklist for web application penetration testing. It outlines the key areas and steps involved in assessing the security of web applications. The checklist covers various testing phases, including information gathering, reconnaissance, vulnerability scanning, manual testing, and reporting. It aims to provide a structured approach for pentesters to ensure thorough coverage of potential security weaknesses. The content focuses on practical methodologies and common attack vectors. |
| 2021-06-28 2021 | Guide To Shopify Webhooks Features And Best Practices beginner 11 min read | Library for managing Shopify webhooks, detailing their features, configuration via Admin Dashboard, GraphQL Admin API, REST Admin API, or app TOML. It covers webhook payload structures, security best practices including HMAC-SHA256 signature verification and responding within 5 seconds, and implementing idempotency using the X-Shopify-Event-Id header. The guide also touches upon GDPR compliance webhooks like customers/data_request and customers/redact. |
| 2021-06-21 2021 | OAuth 2.0 Token Binding intermediate AuthN | OAuth 2.0 Token Binding enhances security by cryptographically binding access tokens to the underlying TLS connection. This prevents token reuse if a token is intercepted, as the attacker would lack the corresponding TLS session key. It ensures that a token can only be used by the client that originally received it, bolstering protection against various attack vectors like token theft and replay attacks. The implementation focuses on securing the token's lifecycle within a specific secure connection. |
| 2021-05-24 2021 | Sending webhooks securely intermediate 6 min read | Library for securely sending webhooks, addressing vulnerabilities like SSRF and DNS rebinding. It details mitigation strategies, including proper IP validation after DNS resolution to prevent attacks like those found in PagerDuty and DialogFlow. The library also covers authentication methods such as request signing with HMAC or digital signatures, and mutual TLS, noting potential issues with confused deputy problems in services like Google DialogFlow and PagerDuty. It recommends using languages with robust TLS implementations like Go or Java over those relying on OpenSSL bindings for certificate chain verification. |
| 2021-05-14 2021 | Creating an Authentication API with GolangUsing Gin & Nrok intermediate AuthN | This article outlines the process of building an authentication API using Golang, the Gin web framework, and Nrok for tunneling. It likely covers setting up a Gin server, implementing authentication logic (e.g., user registration, login, token generation), and using Nrok to expose the local development server for testing. The focus is on practical implementation steps for creating a functional authentication system. |
| 2021-05-06 2021 | CWE-598: Information Exposure Through Query Strings in GET Request beginner | CWE-598 describes the vulnerability where sensitive information is exposed through query strings in GET requests. This occurs when confidential data, such as credentials or personal details, is appended directly to the URL. Attackers can easily access this information through browser history, server logs, or by intercepting network traffic. This practice should be avoided, and sensitive data should be transmitted using more secure methods like POST requests or encrypted channels. |
| 2021-05-06 2021 | XSS Through Parameter Pollution intermediate XSS | This content explains how Cross-Site Scripting (XSS) vulnerabilities can be exploited through parameter pollution. This technique involves injecting malicious scripts by manipulating multiple parameters within a single request. Attackers can leverage this to bypass security filters and execute arbitrary code in a user's browser. The article details the methods used for such attacks and emphasizes the importance of robust input validation to prevent them. |
| 2021-05-04 2021 | OAuth 2.0: Security Considerations beginner 6 min read AuthN | Reference detailing OAuth 2.0 security considerations, including common mistakes in Classic Web Applications, Single Page Applications, and Mobile Applications. It elaborates on design choices, implementation pitfalls, and exploitation techniques, referencing RFCs like 6749 and 7636. The resource utilizes a sample "gallery" application and its integrations like "photoprint" and "mypics" to illustrate secure OAuth 2.0 flows, such as authorization code grant with PKCE, and discusses token introspection and revocation. |