Burp Suite Enterprise Edition is now available in our secure Cloud  –  Learn more
Research Academy
My account Customers About Blog Careers Legal Contact Resellers
Back to all learning paths
PRACTITIONER

API testing

This learning path teaches you how to test APIs that aren't fully used by the website front-end. You'll learn key API recon skills to help you discover more attack surface. In addition, you'll learn how to identify server-side parameter pollution vulnerabilities that may impact internal APIs.

Contents

Get started: API recon

0 of 29

GET STARTED

API recon 0 of 1

API recon Get started

API documentation 0 of 4

API documentation

Discovering API documentation

Lab: Exploiting an API endpoint using documentation APPRENTICE

Using machine-readable documentation

Identifying and interacting with API endpoints 0 of 6

Identifying API endpoints

Interacting with API endpoints

Identifying supported HTTP methods

Identifying supported content types

Lab: Finding and exploiting an unused API endpoint PRACTITIONER

Using Intruder to find hidden endpoints

Finding hidden parameters 0 of 1

Finding hidden parameters

Mass assignment vulnerabilities 0 of 4

Mass assignment vulnerabilities

Identifying hidden parameters

Testing mass assignment vulnerabilities

Lab: Exploiting a mass assignment vulnerability PRACTITIONER

Preventing vulnerabilities in APIs 0 of 1

Preventing vulnerabilities in APIs

Server-side parameter pollution 0 of 1

Server-side parameter pollution

Testing for server-side parameter pollution in the query string 0 of 6

Testing for server-side parameter pollution in the query string

Truncating query strings

Injecting invalid parameters

Injecting valid parameters

Overriding existing parameters

Lab: Exploiting server-side parameter pollution in a query string PRACTITIONER

Testing for server-side parameter pollution in REST paths 0 of 1

Testing for server-side parameter pollution in REST paths

Testing for server-side parameter pollution in structured data formats 0 of 2

Testing for server-side parameter pollution in structured data formats

Testing for server-side parameter pollution in structured data formats - Continued

Testing for server-side parameter pollution with automated tools 0 of 1

Testing with automated tools

Preventing server-side parameter pollution 0 of 1

Preventing server-side parameter pollution