Hands-on notes, labs, and write-ups focused on API penetration testing — covering reconnaissance, authentication attacks, reverse engineering, and exploitation against real-world-style vulnerable APIs (crAPI).
Lab Setup | Initial Configuration.md— Environment and lab setup guideReverse Engineering APIs.md— Techniques for reverse engineering API behavior and structurecrAPI-scanning-and-auth-attacks.md— Scanning crAPI and exploiting authentication flawscrAPI-Pentest.md— Full penetration test walkthrough of crAPI
- 🔍 API Reconnaissance & Endpoint Discovery
- 🔐 Authentication & Authorization Attacks (BOLA, BFLA, JWT abuse)
- 🧩 Reverse Engineering API Logic
- 🐞 Exploiting crAPI (Completely Ridiculous API) vulnerabilities
- 📝 Structured, reproducible pentest documentation
Burp Suite, Postman, crAPI, Kali Linux, and manual testing methodology.
Md Jubair Hossain — Self-taught Penetration Tester
- 🌐 Portfolio
- ✍️ Medium
- 🐦 X / Twitter
All testing shown here was performed in a local/lab environment against intentionally vulnerable applications (crAPI) for educational purposes only. Do not test APIs you do not own or have explicit permission to test.