Hacking APIs: Breaking Web Application Programming Interfaces

Description:

About this item:

You'll learn how REST and GraphQL APIs work in the wild and set up a streamlined API testing lab with Burp Suite and Postman. Then you'll master tools useful for reconnaissance, endpoint analysis, and fuzzing, such as Kiterunner and OWASP Amass. Next, you'll learn to perform common attacks, like those targeting an API's authentication mechanisms and the injection vulnerabilities commonly found in web applications. You'll also learn techniques for bypassing protections against these attacks. In the book's nine guided labs, which target intentionally vulnerable APIs, you'll practice: Enumerating APIs users and endpoints using fuzzing techniques; Using Postman to discover an excessive data exposure vulnerability; Performing a JSON Web Token attack against an API authentication process; Combining multiple API attack techniques to perform a NoSQL injection; Attacking a GraphQL API to uncover a broken object level authorization vulnerability. By the end of the book, you'll be prepared to uncover those high-payout API bugs other hackers aren't finding and improve the security of applications on the web.

Review

Corey Ball takes you on a journey through the lifecycle of APIs in such a manner that you're wanting to not only know more, but also anticipating trying out your newfound knowledge on the next legitimate target. From concepts to examples, through to identifying tools and demonstrating them in fine detail, this book has it all. It IS the motherload for API hacking, and should be found next to the desk, well-read by ANYONE wanting to take this level of adversarial research, assessment, or DevSecOps seriously.
--Chris Roberts, @Sidragon1, vCISO/Researcher/Hacker

This book opens the doors to the field of API Hacking, a subject not very well understood. Using real-world examples that emphasize Access Control issues, this book will help you understand the ins and outs of securing APIs, hunt great bounties, and help organizations improve their API Security!
--Inon Shkedy, @InonShkedy, Security Researcher

About the Author

Corey Ball is a cybersecurity consulting manager at Moss Adams, where he leads its penetration testing services. He has over ten years of experience working in IT and cybersecurity across several industries, including aerospace, agribusiness, energy, financial tech, government services, and healthcare. In addition to a bachelor’s degree in English and philosophy from Sacramento State University, Corey holds the OSCP, CCISO, CEH, CISA, CISM, CRISC, and CGEIT industry certifications.

Review:

5.0 out of 5

100.00% of customers are satisfied

5.0 out of 5 stars Good Paper quality and fast delivery

A. · 27 December 2024

Paper quality was good and it arrived quickly

5.0 out of 5 stars Very useful book

A.-.D. · 6 March 2023

The book is full of valuable information and walks you through deliberately vulnerable API Labs to reinforce what you've learned. Brilliant!

A high tech and foundational cyber security book

T.G. · 7 April 2024

"Hacking APIs" by Corey Ball, published in 2022 by No Starch Press, is a comprehensive guide to web API security testing. APIs, or Application Programming Interfaces, serve as intermediaries between software programs, enabling seamless communication. This book uniquely delves into API fundamentals and security practices, offering clear explanations and practical examples. It covers enumeration tools, vulnerability discovery, and emphasizes the importance of API security in the context of modern cyber trends like microservices. Despite the negative connotations associated with hacking, the book aims to educate cybersecurity enthusiasts on protecting systems rather than causing harm. For beginners, it provides a solid introduction to APIs and their vulnerabilities, while experienced professionals can benefit from its insights into advanced tools and techniques. In a rapidly evolving tech landscape dominated by mobile apps, understanding API security is paramount. "Hacking APIs" reframes the term "hacker" in its original context of creative problem-solving and system improvement, highlighting the crucial role of API security in safeguarding against cyber threats.

Excellent

C.R.a.D. · 21 October 2022

One of the best books I’ve read in a long time. Corey is an exceptional pen tester and mentor. He simplifies and deliver the content is an easy to digest way. The subject is very interesting. He covered a real need in that book.I practically like all No Starch Press publications. 🙂

Must read book for bug hunters and api developers

S.P. · 23 January 2023

Amazing book by corey....i wish i would have bought this book early

Very good

F. · 25 August 2022

I have read the book on 10 days and i feel i can hack APIs, whereas i had a backgroud about web hacking issues, the book is well organized and the reading was done seamlessly. There is a minor caveat, sometimes there is a lack of screenshot when operations in tools are describted, but It just occurs a couple of times or more.

Excellent Resource for API Hacking and Bug Bounty

A.C. · 29 July 2022

The author has done a perfect job of structuring and explaining this book. Not only does he explain in great detail for the beginner how APIs work, he shows in depth how to exploit them and walks you through the latest tools used to enumerate and dissect them and understand what's going on behind the scenes. On top of it all there are labs where you can practice and the book is very well written so that you can follow along throughout and "learn as you go" so to speak.I have been looking for a resource on APIs as I begin bug bounty hunting, and this, by far has been the most valuable by itself. Definitely buy this book if like me, you want to learn about the intricacies of APIs and how to find and exploit the vulnerabilities for bug bounty.

Visit the No Starch Press Store

Hacking APIs: Breaking Web Application Programming Interfaces

Name: Hacking APIs: Breaking Web Application Programming Interfaces
Brand: No Starch Press
SKU: K1718502443
Price: 28.09 BHD
Availability: InStock
Rating: 4.7 (7 reviews)

4.7

^BHD28⁰⁹⁵

Quantity:

Order today to get by

Free delivery on orders over BHD 20

Return and refund policies

Product origin: United Kingdom

All product information listed on the site are from 3rd party sources, including images and reviews. bolo.bh is not liable for any claims or promotions mentioned on the product description or images with textual content. For detailed product information, please contact the manufacturer or Bolo support by logging into your account. Unless stated otherwise during checkout, all import taxes and duty are included in the price mentioned on the product page. bolo.bh follows the rules and regulations of sale in Bahrain and will cancel items in an order that are illegal for sale in Bahrain. We take all the necessary steps to ensure only products for sale in Bahrain are displayed. Product stock and delivery estimate may change with the seller even after placing the order. All items are shipped by air and items marked “Dangerous Goods (DG)” by the IATA will be cancelled from orders. We strive to process your order as soon as it is finalized.

Similar suggestions by Bolo

Similar items from “Introduction to Network & Security”

Books

Computing & Internet

Networking & Security

Introduction to Network & Security