API Security
The OWASP API Top 10 hands-on: BOLA, broken JWT auth, mass assignment — on a vulnerable API you run yourself.
One-time payment · lifetime access · lessons, labs, exam and certificate included · no subscription.
About this course
APIs fail differently from web pages, and the OWASP API Security Top 10 is dominated by authorization bugs. This practical course has you run a deliberately vulnerable API locally, then hunt the classic flaws with nothing but curl and jq. You learn API recon, then exploit Broken Object Level Authorization by changing an id, forge an unsigned token against a server that trusts the alg:none JWT, and escalate your role through mass assignment by adding a field the API blindly binds. A survey lesson covers broken function-level authorization, excessive data exposure, missing rate limiting and SSRF. Each bug is paired with the concrete server-side fix, and the final exam asks you to find all three core issues on your own target and write up the highest-severity finding.