Practical API Hacking TCM

Practical API Hacking TCM is a hands-on program from TCM Security that teaches you ethical API penetration testing through real vulnerable APIs. You will learn API reconnaissance including discovering hidden endpoints, enumeration with tools like Arjun and Kiterunner and analyzing OpenAPI specifications. The course covers authentication attacks including JWT none algorithm, weak signing, token leakage and OAuth misconfigurations. You will master Broken Object Level Authorization and Broken Function Level Authorization exploiting IDOR vulnerabilities in REST endpoints. The course teaches mass assignment, excessive data exposure, injection attacks and rate limiting bypass for API abuse. You will practice GraphQL specific attacks including introspection abuse, query batching and complexity attacks that cause denial of service. The course covers API versioning flaws, shadow API discovery and business logic abuse unique to API ecosystems. You will work with Burp Suite, Postman and custom scripts to automate testing and chain vulnerabilities into full exploitation paths. The course includes a dedicated vulnerable API lab environment with step-by-step walkthroughs for each OWASP API Top 10 category. By the end you will be able to conduct professional API security assessments and report findings with remediation guidance.

What's Included

• 16 hours of HD video
• Vulnerable API lab
• JWT & BOLA exploitation
• Certificate of completion