API301 — Mastery of API Pentesting

Hands-on notes, labs, and write-ups focused on API penetration testing — covering reconnaissance, authentication attacks, reverse engineering, and exploitation against real-world-style vulnerable APIs (crAPI).

Contents

• Lab Setup | Initial Configuration.md — Environment and lab setup guide
• Reverse Engineering APIs.md — Techniques for reverse engineering API behavior and structure
• crAPI-scanning-and-auth-attacks.md — Scanning crAPI and exploiting authentication flaws
• crAPI-Pentest.md — Full penetration test walkthrough of crAPI

What This Covers

• 🔍 API Reconnaissance & Endpoint Discovery
• 🔐 Authentication & Authorization Attacks (BOLA, BFLA, JWT abuse)
• 🧩 Reverse Engineering API Logic
• 🐞 Exploiting crAPI (Completely Ridiculous API) vulnerabilities
• 📝 Structured, reproducible pentest documentation

Tools Used

Burp Suite, Postman, crAPI, Kali Linux, and manual testing methodology.

Author

Md Jubair Hossain — Self-taught Penetration Tester

• 🔗 LinkedIn
• 🌐 Portfolio
• ✍️ Medium
• 🐦 X / Twitter

⚠️ Disclaimer

All testing shown here was performed in a local/lab environment against intentionally vulnerable applications (crAPI) for educational purposes only. Do not test APIs you do not own or have explicit permission to test.