hackXpert labs
All labs › API Hacking

🔌 API Hacking

No UI to hide behind. Get the spec, walk the versions, try every method on every endpoint, and send the fields the API never asked for.

16 labs and targetsfree accountlesson included
How api hacking actually works — taught by The XSS Rat

What it is

APIs strip away the front end that was quietly enforcing half the rules. The same object is reachable by id, the same action by method, and documentation often describes more than the UI ever exposes.

How I attack it

  1. Get the spec if there is one - swagger, graphql introspection, the JS client. It is a map of everything.
  2. Walk the versions. v1 is frequently still live and far less careful than v3.
  3. Test every method on every endpoint, not just the ones the client uses.
  4. Mass assignment: add the fields the API did not ask for and see which ones it writes anyway.

Learn it from The XSS Rat

▶ Watch: API hacking on YouTube ✍ Read: api hacking on Medium 🎓 Course: CAPIE - API Hacking

Free reference reading

PortSwigger Academy: API testingPortSwigger Academy: GraphQLOWASP API Security Top 10 (2023)

On this host 6

Start here

API basics

What an endpoint is, what a method is, and what the spec tells you.

Authentication

Tokens and keys against an API rather than a login form.

Enumeration

Finding the endpoints the documentation forgot.

RatCode

Read the client, find the API.

Hosted targets 10

Separate services on their own ports, each with its own documentation.

Off-site

Rat Play

Swagger docs, full API to hunt.

Off-site

Items API

Raw REST collection, no docs. Work it out.

Off-site

Books API

Raw REST collection, no docs.

Also here 2

CAPIE course materialStart the docker labs
Nothing matches thatClear the filter to see everything again.