API Badge

The API badge is our set of exercises created to help you learn API testing. The first few challenges are based on challenges you already solved to get you more confident with API testing and review your knowledge and methodology. Then, harder challenges are provided to get you to the next level.

41 exercises 116 completed 43 videos

Exercises

This exercise is the API version of an exercise you already solved in the Essential Badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.
1 video
Completed by 3745 students
Takes < 1 Hr. on average
Rails/Angular
API
cwe-639,cwe-284

This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.
1 video
Completed by 3217 students
Takes < 1 Hr. on average
Rails/Angular
API
CWE-327

This exercise is the API version of an exercise you already solved in another badge. You should use it to get more confident with discovering vulnerabilities without any hint on what to look for.
1 video
Completed by 2547 students
Takes < 1 Hr. on average
Rails/Angular
API
CWE-327

This exercise covers how one can inspect JavaScript code to identify unused endpoints.
1 video
Completed by 2581 students
Takes < 1 Hr. on average
Rails/Angular
API, Angular
CWE-1028

This exercise covers how one can inspect JavaScript code to identify unused endpoints.
1 video
Completed by 2390 students
Takes < 1 Hr. on average
Rails/Angular
API, Angular
CWE-1028

This exercise covers how one can inspect JavaScript code to identify unused endpoints.
1 video
Completed by 2073 students
Takes < 1 Hr. on average
Rails/Angular
API, Angular
CWE-1028

This exercise covers how one can inspect JavaScript code to identify information leak.
1 video
Completed by 1938 students
Takes < 1 Hr. on average
Rails/Angular
API, Angular
CWE-950

This exercise covers how one can inspect HTTP responses to identify information leaks.
1 video
Completed by 1841 students
Takes < 1 Hr. on average
Rails/Angular
CWE-200

This exercise covers how one can inspect HTTP responses to identify information leaks.
1 video
Completed by 1037 students
Takes < 1 Hr. on average
Rails/Angular

This exercise covers a common filter bypass in API.
1 video
Completed by 905 students
Takes < 1 Hr. on average
Golang/Vue

This exercise covers a common filter bypass in API.
1 video
Completed by 836 students
Takes < 1 Hr. on average
Golang/Vue

This exercise covers a common filter bypass in API.
1 video
Completed by 795 students
Takes < 1 Hr. on average
Golang/Vue

This exercise covers a complex filter bypass in API.
1 video
Completed by 714 students
Takes < 1 Hr. on average
Golang/Vue

This exercise covers how to exploit a leaked encrypted password with an API.
1 video
Completed by 744 students
Takes < 1 Hr. on average
Golang/Vue

This exercise covers how to exploit a leaked encrypted password with an API.
1 video
Completed by 655 students
Takes < 1 Hr. on average
Golang/Vue

This exercise covers how to exploit an authorization issue in an API.
2 videos
Completed by 584 students
Takes < 1 Hr. on average
Golang

This exercise covers how to exploit an authorization issue in an API.
2 videos
Completed by 493 students
Takes < 1 Hr. on average
Golang

This exercise covers how to exploit an authorization issue in an API.
2 videos
Completed by 582 students
Takes < 1 Hr. on average
Golang

This exercise covers how to exploit an authorization issue in an API.
1 video
Completed by 569 students
Takes < 1 Hr. on average
Golang

This exercise covers how to exploit an authorization issue in an API.
1 video
Completed by 552 students
Takes < 1 Hr. on average
Golang

API JWT REVOCATION

This exercise covers how to bypass a weak JWT Revocation Mechanism.
1 video
Completed by 507 students
Takes < 1 Hr. on average
Ruby-on-Rails
JWT

API Mass-Assignment 01

1 video
Completed by 516 students
Takes < 1 Hr. on average
Ruby-on-Rails

API Mass-Assignment 02

1 video
Completed by 488 students
Takes < 1 Hr. on average
Ruby-on-Rails

API Mass-Assignment 03

1 video
Completed by 456 students
Takes < 1 Hr. on average
Ruby-on-Rails

API Payments 01

This exercise covers a simple payments bypass.
2 videos
Completed by 2036 students
Takes < 1 Hr. on average
Rails/Angular
API
CWE-288,CWE-354,CWE-472

API Payments 02

This exercise covers a simple payments bypass.
2 videos
Completed by 1538 students
Takes < 1 Hr. on average
Rails/Angular
CWE-354,CWE-472

API Payments 03

This exercise covers a simple payments bypass.
2 videos
Completed by 1370 students
Takes < 1 Hr. on average
Rails/Angular
CWE-354,CWE-472

API Payments 04

This exercise covers how to abuse a shopping cart allowing users to apply a voucher..
2 videos
Completed by 1259 students
Takes < 1 Hr. on average
Rails/Angular
CWE-472

API Payments 05

This exercise covers how to abuse a shopping cart allowing users to apply a voucher.
1 video
Completed by 947 students
Takes < 1 Hr. on average
Rails/Angular
CWE-345,CWE-693

API Payments 06

This exercise covers a simple payments bypass.
2 videos
Completed by 1041 students
Takes < 1 Hr. on average
Rails/Angular
CWE-472

API Payments 07

This exercise covers a way to manipulate a shopping cart to lower the total amount
2 videos
Completed by 1008 students
Takes < 1 Hr. on average
Rails/Angular
CWE-353

GraphQL Authorization 01

This exercise covers a simple authorization issue in a GraphQL application.
1 video
Completed by 454 students
Takes < 1 Hr. on average
GraphQL/Node

GraphQL Authorization 02

This exercise covers a simple authorization issue in a GraphQL application.
1 video
Completed by 463 students
Takes < 1 Hr. on average
GraphQL/Node

This challenge covers how to exploit an IDOR when Mongo IDs are used
1 video
Completed by 1223 students
Takes < 1 Hr. on average
ROR/MongoDB

This challenge covers how to recover a Mongo ID to leverage an IDOR
Completed by 377 students
Takes < 1 Hr. on average
ROR/MongoDB

Completed by 262 students
Takes < 1 Hr. on average
ROR/MongoDB

Completed by 157 students
Takes 2-4 Hrs. on average
ROR/MongoDB

This exercise covers how to exploit a simple ORM leak.
Completed by 292 students
Takes 1-2 Hrs. on average
Python

This exercise covers how to exploit an ORM leak vulnerability
Completed by 245 students
Takes < 1 Hr. on average
Python

ORM LEAK: SQLite

This exercise covers how to exploit an ORM leak vulnerability
Completed by 170 students
Takes 1-2 Hrs. on average
Python

Completed by 231 students
Takes 1-2 Hrs. on average
ROR