Api security course

Lesson 1 • API Threat Actors and Attack Motivations

Profiles external attackers, malicious insiders, and automated bots targeting APIs. Grounds threat modelling in realistic adversary goals and capabilities.

Lesson 2 • API Data Flow and Trust Boundaries

Maps how data moves between clients, APIs, and backends, identifying where trust boundaries exist. Connects data flow analysis to threat modelling in later chapters.

Lesson 3 • API Architecture and Communication Models

Covers REST, GraphQL, gRPC, and SOAP architectures and how each exposes distinct security surfaces. Establishes vocabulary used throughout the course.

Lesson 4 • Common API Vulnerability Categories

Introduces the OWASP API Security Top 10 as a structured taxonomy of API weaknesses. Provides context for the attack techniques covered in subsequent chapters.

Lesson 1 • Attack Surface Documentation

Structures discovered endpoints, parameters, and authentication mechanisms into a prioritised attack surface report. Prepares students for systematic exploitation planning.

Lesson 2 • API Documentation Analysis

Extracts security-relevant details from OpenAPI, Swagger, and Postman collections to identify risky endpoints. Teaches how documentation itself becomes an attacker resource.

Lesson 3 • Traffic Interception and Analysis

Captures and decodes API traffic using proxy tools to reveal hidden parameters and authentication tokens. Directly feeds into the exploitation techniques in subsequent chapters.

Lesson 4 • Passive API Discovery Techniques

Uses OSINT, public documentation, and traffic analysis to identify API endpoints without direct interaction. Establishes reconnaissance discipline before active scanning.

Lesson 1 • OAuth 2.0 Flows and Security Pitfalls

Breaks down authorisation code, implicit, and client credentials flows, highlighting where each introduces vulnerabilities. Prepares students to test OAuth implementations.

Lesson 2 • API Key Management and Weaknesses

Examines how API keys are issued, transmitted, and stored, and where they fail. Connects poor key hygiene to real-world credential exposure incidents.

Lesson 3 • JSON Web Token Security

Analyses JWT structure, signing algorithms, and common implementation errors that allow token forgery. Directly supports the authorisation bypass attacks covered next.

Lesson 4 • Function-Level Authorisation Failures

Covers broken function-level authorisation where HTTP methods or admin endpoints are improperly restricted. Connects to API design review techniques in later chapters.

Lesson 1 • NoSQL and GraphQL Injection

Explores operator injection in MongoDB-style APIs and introspection abuse in GraphQL endpoints. Extends injection concepts to non-relational and query-language APIs.

Lesson 2 • XML and Deserialisation Attacks

Examines XXE injection in XML-accepting APIs and insecure deserialisation in object-based endpoints. Connects these attack classes to data exfiltration and remote code execution.

Lesson 3 • SQL Injection via API Endpoints

Demonstrates how API parameters pass unsanitised input to SQL queries, enabling data extraction and manipulation. Covers both manual and tool-assisted detection methods.

Lesson 4 • Command and Server-Side Injection

Covers OS command injection and server-side template injection triggered through API parameters. Highlights the critical severity of these vulnerabilities in API contexts.

Lesson 1 • API Denial-of-Service Techniques

Covers application-layer DoS via large payloads, recursive queries, and regex complexity attacks. Connects resource exhaustion to availability risk in production APIs.

Lesson 2 • Rate Limiting Concepts and Bypass

Explains token bucket, leaky bucket, and fixed-window rate limiting models and their bypass techniques. Establishes the foundation for testing API throttling controls.

Lesson 3 • Implementing Effective Throttling Controls

Teaches configuration of rate limits, quotas, and circuit breakers at the API gateway and application layer. Provides remediation skills to complement the attack techniques above.

Lesson 1 • Assessment Reporting and Evidence Collection

Teaches structured vulnerability reporting with CVSS scoring, reproduction steps, and remediation guidance. Produces professional deliverables that communicate risk to technical and business audiences.

Lesson 2 • Vulnerability Chaining and Exploit Development

Demonstrates how individual low-severity findings combine into high-impact exploit chains. Elevates students from finding individual bugs to demonstrating real business risk.

Lesson 3 • Assessment Scoping and Rules of Engagement

Defines how to scope API assessments, establish testing boundaries, and document rules of engagement. Ensures legal and ethical clarity before any active testing begins.

Lesson 4 • Automated API Scanning Tools

Covers configuration and use of automated scanners including DAST tools and API-specific fuzzers. Positions automation as a complement to, not replacement for, manual testing.

Lesson 1 • Input Validation and Output Encoding

Defines server-side validation, schema enforcement, and output encoding requirements that eliminate injection risks. Reinforces the attack techniques from Chapter 3 with developer-side controls.

Lesson 2 • Secure Authentication Implementation

Specifies implementation requirements for OAuth 2.0, JWT, and API key systems that resist the attacks covered earlier. Connects attacker techniques to concrete developer countermeasures.

Lesson 3 • Authorisation Design Patterns

Covers attribute-based, role-based, and object-level authorisation models that prevent BOLA and privilege escalation. Provides reusable design patterns applicable across API frameworks.

Lesson 4 • API Security Headers and Transport Security

Specifies required HTTP security headers, TLS configuration, and certificate management for API endpoints. Provides a hardening checklist applicable to any API deployment.

Lesson 1 • API Inventory and Lifecycle Governance

Establishes processes for maintaining a complete API inventory, managing versioning, and retiring deprecated endpoints. Addresses shadow API risk and governance gaps in large organisations.

Lesson 2 • Zero Trust Principles for APIs

Applies zero trust concepts including mutual TLS, continuous verification, and least-privilege access to API ecosystems. Extends the authorisation design patterns from Chapter 7 to architectural scale.

Lesson 3 • API Gateway Security Architecture

Designs gateway-layer controls including authentication enforcement, traffic inspection, and policy management. Positions the gateway as the primary enforcement point in API security architecture.

Lesson 4 • Threat Modelling for API Systems

Applies STRIDE and data flow diagram techniques to API architectures to identify design-level threats. Integrates threat modelling into the API design review process.