Bilal k. Mohammed·2d agoAPI-P-2: How to Find Excessive Data Exposure Using Postman and Burp SuiteA practical walkthrough of API documentation analysis, authentication, endpoint discovery, and identifying sensitive information hidden…
Bilal k. Mohammed·3d agoAPI-P-1: Reverse Engineering an API: Building API Documentation with Postman and mitmproxy2swaggerAPI 1 — A practical guide to discovering undocumented API endpoints, capturing HTTP traffic, generating OpenAPI specifications, and…
sahan chamod·Sep 30Advanced API Penetration Testing: JWT, OAuth2, GraphQL & Business Logic AttacksModern applications increasingly depend on APIs for authentication, payments, mobile applications, microservices, cloud infrastructure, and…
InSystem WeaknessbyImran Niaz·Sep 16I applied to a company, and they rejected me; then I hacked their server.Hacker Meets Developer — A Random Encounter
PaulHaykeens·Sep 2When an AI Backend Forgot to Ask Who You Were: Finding Unauthenticated LLM Invocation in a FigmaBot…Hello, my name is Godwin Akinyomi, although I use Paul Haykeens as my public identity as a security researcher.
Sanjeev Rathore·Aug 23Write up of the APISEC-LABHello everybody this is the complete write up of the APISEC-LAB. This post will cover all the key vulnerabilities that must be found in the…
Tracie M. Smith·Aug 8BOLA Explained: When APIs Forget Who Owns WhatAPIs power almost everything today — from mobile apps and banking platforms to e-commerce sites and SaaS products. But as APIs become more…
Hasyyb·Jul 26Open Redirect Vulnerabilities: How Whitelist Validation Gets BypassedOpen redirect bugs are deceptively simple — and deceptively easy to get wrong. A single string-matching mistake in a “safe domain” check…
Katherine Williams·Jul 22Beyond Web Pentesting: Why API Pentesting Should Be Your Next StepWhen I first started learning web application security, my focus was on vulnerabilities like SQL Injection, Cross-Site Scripting (XSS)…
David Banjo·Jul 10Breaking JSON Web Tokens: My Hunt for the “alg:none” Vulnerability in crAPIPart 1 of a 2-part series on JWT attacks against crAPI [Read part 2 here]
