[{"data":1,"prerenderedAt":1128},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-api-penetration-testing-pt1":33,"post-nav-api-penetration-testing-pt1":1106,"video-api-penetration-testing-pt1":1118,"i-tabler:copy":1126},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":1092,"coverImage":1095,"date":1096,"description":1097,"draft":14,"extension":1098,"meta":1099,"navigation":30,"noindex":14,"path":1100,"readingTime":1101,"seo":1102,"slug":1103,"stem":1103,"updatedAt":1104,"youtubeId":42,"__hash__":1105},"blog\u002Fapi-penetration-testing-pt1.md","API Penetration Testing 🔐",{"type":37,"value":38,"toc":1050},"minimark",[39,43,47,50,53,58,63,79,83,86,140,144,147,151,156,159,179,190,194,267,273,276,292,295,301,328,334,390,396,413,419,435,441,460,464,480,486,539,545,595,601,621,625,631,647,649,653,659,668,744,746,750,754,760,766,772,777,783,824,830,833,837,843,920,926,953,959,1015,1021,1034,1036,1040,1043,1046],[40,41],"post-media",{"video":42},"ZPrDyLyuWYI",[44,45,46],"p",{},"Setting up a solid environment is the foundation of any successful API penetration test. In this article, we’ll walk you through creating a powerful hacking setup, from installing Kali Linux to configuring essential tools and setting up labs specifically designed for API testing. This guide is crafted to help you uncover hidden API endpoints, understand how to leverage tools like Burp Suite, OWASP ZAP, and FoxyProxy, and set up reconnaissance tools that make API hacking efficient and effective.",[44,48,49],{},"Whether you're just starting out or looking to refine your approach, this guide ensures you’re well-equipped for hands-on API testing. So grab a coffee, follow along, and let’s get this setup ready to tackle any API challenge!",[51,52],"hr",{},[54,55,57],"h2",{"id":56},"setting-up-the-environment","Setting Up the Environment",[59,60,62],"h3",{"id":61},"_1-install-kali-linux","1. Install Kali Linux",[44,64,65,66,78],{},"Download and set up the Kali Linux 64-bit VM via VMware from the ",[67,68,74],"a",{"href":69,"rel":70,"target":73},"https:\u002F\u002Fwww.kali.org\u002Fget-kali\u002F?utm_source=amrelsagaei.com&utm_medium=referral#kali-virtual-machines",[71,72],"noopener","noreferrer","_blank",[75,76,77],"strong",{},"official Kali website",".",[59,80,82],{"id":81},"_2-update-kali","2. Update Kali",[44,84,85],{},"Ensure your Kali installation is up-to-date with the following commands:",[87,88,93],"pre",{"code":89,"language":90,"meta":91,"className":92,"style":91},"sudo apt update -y\nsudo apt upgrade -y\nsudo apt dist-upgrade -y\n","bash","","shiki shiki-themes vitesse-dark vitesse-light",[94,95,96,116,128],"code",{},[97,98,101,105,109,112],"span",{"class":99,"line":100},"line",1,[97,102,104],{"class":103},"swzfi","sudo",[97,106,108],{"class":107},"sRRDT"," apt",[97,110,111],{"class":107}," update",[97,113,115],{"class":114},"se4ZP"," -y\n",[97,117,119,121,123,126],{"class":99,"line":118},2,[97,120,104],{"class":103},[97,122,108],{"class":107},[97,124,125],{"class":107}," upgrade",[97,127,115],{"class":114},[97,129,131,133,135,138],{"class":99,"line":130},3,[97,132,104],{"class":103},[97,134,108],{"class":107},[97,136,137],{"class":107}," dist-upgrade",[97,139,115],{"class":114},[59,141,143],{"id":142},"_3-update-user-accounts","3. Update User Accounts",[44,145,146],{},"After setting up the OS, updating default credentials is a security best practice.",[59,148,150],{"id":149},"_4-install-essential-tools","4. Install Essential Tools",[152,153,155],"h4",{"id":154},"burp-suite-community-edition","Burp Suite Community Edition",[44,157,158],{},"Burp Suite is crucial for intercepting and analyzing HTTP requests.",[87,160,162],{"code":161,"language":90,"meta":91,"className":92,"style":91},"sudo apt-get install burpsuite -y\n",[94,163,164],{},[97,165,166,168,171,174,177],{"class":99,"line":100},[97,167,104],{"class":103},[97,169,170],{"class":107}," apt-get",[97,172,173],{"class":107}," install",[97,175,176],{"class":107}," burpsuite",[97,178,115],{"class":114},[44,180,181,182,189],{},"Download Jython from ",[67,183,186],{"href":184,"rel":185,"target":73},"https:\u002F\u002Fwww.jython.org\u002Fdownload.html?utm_source=amrelsagaei.com&utm_medium=referral",[71,72],[75,187,188],{},"jython.org","and add the .jar file to the Extender Options in Burp Suite.",[152,191,193],{"id":192},"foxyproxy-standard","FoxyProxy Standard",[195,196,197],"ul",{},[198,199,200,201],"li",{},"FoxyProxy lets you control traffic routing, especially useful when switching between Burp and other proxies.",[202,203,204,218,243],"ol",{},[198,205,206,209,216],{},[75,207,208],{},"Install FoxyProxy from",[67,210,213],{"href":211,"rel":212,"target":73},"https:\u002F\u002Faddons.mozilla.org\u002Fen-US\u002Ffirefox\u002Faddon?utm_source=amrelsagaei.com&utm_medium=referral",[71,72],[75,214,215],{},"here",[75,217,78],{},[198,219,220,223],{},[75,221,222],{},"Configure Proxies:",[202,224,225,235],{},[198,226,227,228,231,232,78],{},"BurpSuite Proxy: Set IP to ",[94,229,230],{},"127.0.0.1",", Port to ",[94,233,234],{},"8080",[198,236,237,238,231,240,78],{},"Postman Proxy: Set IP to ",[94,239,230],{},[94,241,242],{},"5555",[198,244,245,248],{},[75,246,247],{},"Burp Suite Certificate",[202,249,250,253,264],{},[198,251,252],{},"Using FoxyProxy, select the BurpSuite proxy.",[198,254,255,256,263],{},"Visit ",[67,257,260],{"href":258,"rel":259,"target":73},"http:\u002F\u002Fburpsuite\u002F?utm_source=amrelsagaei.com&utm_medium=referral",[71,72],[75,261,262],{},"http:\u002F\u002Fburpsuite"," and download the CA certificate.",[198,265,266],{},"Import the certificate into Firefox.",[152,268,270],{"id":269},"owasp-zap",[75,271,272],{},"OWASP ZAP",[44,274,275],{},"Another essential tool for security testing.",[87,277,279],{"code":278,"language":90,"meta":91,"className":92,"style":91},"sudo apt install zaproxy\n",[94,280,281],{},[97,282,283,285,287,289],{"class":99,"line":100},[97,284,104],{"class":103},[97,286,108],{"class":107},[97,288,173],{"class":107},[97,290,291],{"class":107}," zaproxy\n",[44,293,294],{},"Navigate to Manage Add-Ons (CTRL+U) to update Fuzzer and OpenAPI Support.",[152,296,298],{"id":297},"mitmweb-certificate-setup",[75,299,300],{},"MITMweb Certificate Setup",[195,302,303,309,312,326],{},[198,304,305,306],{},"Start MITMweb: ",[94,307,308],{},"mitmweb",[198,310,311],{},"Use FoxyProxy to route traffic to BurpSuite.",[198,313,314,315,318,319,78],{},"Download the ",[94,316,317],{},"mitmproxy-ca-cert.pem"," from ",[67,320,323],{"href":321,"rel":322,"target":73},"https:\u002F\u002Fmitm.it\u002F?utm_source=amrelsagaei.com&utm_medium=referral",[71,72],[75,324,325],{},"mitm.it",[198,327,266],{},[152,329,331],{"id":330},"install-postman",[75,332,333],{},"Install Postman",[87,335,337],{"code":336,"language":90,"meta":91,"className":92,"style":91},"sudo wget https:\u002F\u002Fdl.pstmn.io\u002Fdownload\u002Flatest\u002Flinux64 -O postman-linux-x64.tar.gz\nsudo tar -xvzf postman-linux-x64.tar.gz -C \u002Fopt\nsudo ln -s \u002Fopt\u002FPostman\u002FPostman \u002Fusr\u002Fbin\u002Fpostman\n",[94,338,339,355,374],{},[97,340,341,343,346,349,352],{"class":99,"line":100},[97,342,104],{"class":103},[97,344,345],{"class":107}," wget",[97,347,348],{"class":107}," https:\u002F\u002Fdl.pstmn.io\u002Fdownload\u002Flatest\u002Flinux64",[97,350,351],{"class":114}," -O",[97,353,354],{"class":107}," postman-linux-x64.tar.gz\n",[97,356,357,359,362,365,368,371],{"class":99,"line":118},[97,358,104],{"class":103},[97,360,361],{"class":107}," tar",[97,363,364],{"class":114}," -xvzf",[97,366,367],{"class":107}," postman-linux-x64.tar.gz",[97,369,370],{"class":114}," -C",[97,372,373],{"class":107}," \u002Fopt\n",[97,375,376,378,381,384,387],{"class":99,"line":130},[97,377,104],{"class":103},[97,379,380],{"class":107}," ln",[97,382,383],{"class":114}," -s",[97,385,386],{"class":107}," \u002Fopt\u002FPostman\u002FPostman",[97,388,389],{"class":107}," \u002Fusr\u002Fbin\u002Fpostman\n",[152,391,393],{"id":392},"install-mitmproxy2swagger",[75,394,395],{},"Install mitmproxy2swagger",[87,397,399],{"code":398,"language":90,"meta":91,"className":92,"style":91},"sudo pip3 install mitmproxy2swagger\n",[94,400,401],{},[97,402,403,405,408,410],{"class":99,"line":100},[97,404,104],{"class":103},[97,406,407],{"class":107}," pip3",[97,409,173],{"class":107},[97,411,412],{"class":107}," mitmproxy2swagger\n",[152,414,416],{"id":415},"install-git",[75,417,418],{},"Install Git",[87,420,422],{"code":421,"language":90,"meta":91,"className":92,"style":91},"sudo apt-get install git\n",[94,423,424],{},[97,425,426,428,430,432],{"class":99,"line":100},[97,427,104],{"class":103},[97,429,170],{"class":107},[97,431,173],{"class":107},[97,433,434],{"class":107}," git\n",[152,436,438],{"id":437},"install-docker",[75,439,440],{},"Install Docker",[87,442,444],{"code":443,"language":90,"meta":91,"className":92,"style":91},"sudo apt-get install docker.io docker-compose\n",[94,445,446],{},[97,447,448,450,452,454,457],{"class":99,"line":100},[97,449,104],{"class":103},[97,451,170],{"class":107},[97,453,173],{"class":107},[97,455,456],{"class":107}," docker.io",[97,458,459],{"class":107}," docker-compose\n",[152,461,463],{"id":462},"install-go","Install Go",[87,465,467],{"code":466,"language":90,"meta":91,"className":92,"style":91},"sudo apt install golang-go\n",[94,468,469],{},[97,470,471,473,475,477],{"class":99,"line":100},[97,472,104],{"class":103},[97,474,108],{"class":107},[97,476,173],{"class":107},[97,478,479],{"class":107}," golang-go\n",[152,481,483],{"id":482},"install-jwt-toolkit",[75,484,485],{},"Install JWT Toolkit",[87,487,489],{"code":488,"language":90,"meta":91,"className":92,"style":91},"cd \u002Fopt\nsudo git clone https:\u002F\u002Fgithub.com\u002Fticarpi\u002Fjwt_tool\ncd jwt_tool\npip3 install termcolor cprint pycryptodomex requests\n",[94,490,491,499,512,519],{},[97,492,493,497],{"class":99,"line":100},[97,494,496],{"class":495},"s6_DI","cd",[97,498,373],{"class":107},[97,500,501,503,506,509],{"class":99,"line":118},[97,502,104],{"class":103},[97,504,505],{"class":107}," git",[97,507,508],{"class":107}," clone",[97,510,511],{"class":107}," https:\u002F\u002Fgithub.com\u002Fticarpi\u002Fjwt_tool\n",[97,513,514,516],{"class":99,"line":130},[97,515,496],{"class":495},[97,517,518],{"class":107}," jwt_tool\n",[97,520,522,525,527,530,533,536],{"class":99,"line":521},4,[97,523,524],{"class":103},"pip3",[97,526,173],{"class":107},[97,528,529],{"class":107}," termcolor",[97,531,532],{"class":107}," cprint",[97,534,535],{"class":107}," pycryptodomex",[97,537,538],{"class":107}," requests\n",[152,540,542],{"id":541},"install-kiterunner",[75,543,544],{},"Install Kiterunner",[87,546,548],{"code":547,"language":90,"meta":91,"className":92,"style":91},"sudo git clone https:\u002F\u002Fgithub.com\u002Fassetnote\u002Fkiterunner.git\ncd kiterunner\nsudo make build\nsudo ln -s \u002Fopt\u002Fkiterunner\u002Fdist\u002Fkr \u002Fusr\u002Fbin\u002Fkr\\\n",[94,549,550,561,568,578],{},[97,551,552,554,556,558],{"class":99,"line":100},[97,553,104],{"class":103},[97,555,505],{"class":107},[97,557,508],{"class":107},[97,559,560],{"class":107}," https:\u002F\u002Fgithub.com\u002Fassetnote\u002Fkiterunner.git\n",[97,562,563,565],{"class":99,"line":118},[97,564,496],{"class":495},[97,566,567],{"class":107}," kiterunner\n",[97,569,570,572,575],{"class":99,"line":130},[97,571,104],{"class":103},[97,573,574],{"class":107}," make",[97,576,577],{"class":107}," build\n",[97,579,580,582,584,586,589,592],{"class":99,"line":521},[97,581,104],{"class":103},[97,583,380],{"class":107},[97,585,383],{"class":114},[97,587,588],{"class":107}," \u002Fopt\u002Fkiterunner\u002Fdist\u002Fkr",[97,590,591],{"class":107}," \u002Fusr\u002Fbin\u002Fkr",[97,593,594],{"class":114},"\\\n",[152,596,598],{"id":597},"install-arjun",[75,599,600],{},"Install Arjun",[195,602,603],{},[198,604,605],{},[87,606,608],{"code":607,"language":90,"meta":91,"className":92,"style":91},"sudo apt install arjun\n",[94,609,610],{},[97,611,612,614,616,618],{"class":99,"line":100},[97,613,104],{"class":103},[97,615,108],{"class":107},[97,617,173],{"class":107},[97,619,620],{"class":107}," arjun\n",[59,622,624],{"id":623},"_5-useful-wordlists","5. Useful Wordlists",[152,626,628],{"id":627},"seclists",[75,629,630],{},"SecLists",[87,632,634],{"code":633,"language":90,"meta":91,"className":92,"style":91},"sudo apt install seclists\n",[94,635,636],{},[97,637,638,640,642,644],{"class":99,"line":100},[97,639,104],{"class":103},[97,641,108],{"class":107},[97,643,173],{"class":107},[97,645,646],{"class":107}," seclists\n",[51,648],{},[54,650,652],{"id":651},"configuring-the-hacking-lab","Configuring the Hacking Lab",[152,654,656],{"id":655},"crapi",[75,657,658],{},"crAPI",[44,660,661,667],{},[67,662,665],{"href":663,"rel":664,"target":73},"https:\u002F\u002Fgithub.com\u002FOWASP\u002FcrAPI?utm_source=amrelsagaei.com&utm_medium=referral",[71,72],[75,666,658],{},"is an API security testing lab from OWASP.",[195,669,670],{},[198,671,672,673,740,743],{},"Create a lab directory and set up crAPI:",[87,674,676],{"code":675,"language":90,"meta":91,"className":92,"style":91},"cd ~\nmkdir labs\nsudo curl -o docker-compose.yml https:\u002F\u002Fraw.githubusercontent.com\u002FOWASP\u002FcrAPI\u002Fmain\u002Fdeploy\u002Fdocker\u002Fdocker-compose.yml\nsudo docker-compose pull\nsudo docker-compose -f docker-compose.yml --compatibility up -d\n",[94,677,678,685,693,709,719],{},[97,679,680,682],{"class":99,"line":100},[97,681,496],{"class":495},[97,683,684],{"class":107}," ~\n",[97,686,687,690],{"class":99,"line":118},[97,688,689],{"class":103},"mkdir",[97,691,692],{"class":107}," labs\n",[97,694,695,697,700,703,706],{"class":99,"line":130},[97,696,104],{"class":103},[97,698,699],{"class":107}," curl",[97,701,702],{"class":114}," -o",[97,704,705],{"class":107}," docker-compose.yml",[97,707,708],{"class":107}," https:\u002F\u002Fraw.githubusercontent.com\u002FOWASP\u002FcrAPI\u002Fmain\u002Fdeploy\u002Fdocker\u002Fdocker-compose.yml\n",[97,710,711,713,716],{"class":99,"line":521},[97,712,104],{"class":103},[97,714,715],{"class":107}," docker-compose",[97,717,718],{"class":107}," pull\n",[97,720,722,724,726,729,731,734,737],{"class":99,"line":721},5,[97,723,104],{"class":103},[97,725,715],{"class":107},[97,727,728],{"class":114}," -f",[97,730,705],{"class":107},[97,732,733],{"class":114}," --compatibility",[97,735,736],{"class":107}," up",[97,738,739],{"class":114}," -d\n",[741,742],"br",{},"If you encounter installation issues, consider using the development version available on GitHub or APIsec’s hosted instance.",[51,745],{},[54,747,749],{"id":748},"api-reconnaissance-techniques","API Reconnaissance Techniques",[59,751,753],{"id":752},"_1-passive-reconnaissance","1. Passive Reconnaissance",[152,755,757],{"id":756},"google-dorking",[75,758,759],{},"Google Dorking",[87,761,764],{"code":762,"language":763,"meta":91},"inurl:\u002Fwp-json\u002Fwp\u002Fv2\u002Fusers\ninurl:\u002Fapi\u002Fv1 intext:index of \u002F\nintitle:index.of intext:api.txt\nintitle:index of api_key OR api key OR apiKey -pool\n","text",[94,765,762],{},[152,767,769],{"id":768},"git-dorking",[75,770,771],{},"Git Dorking",[87,773,775],{"code":774,"language":763,"meta":91},"api key\napi keys\napikey\nauthorization: Bearer\naccess_token\ntoken\n",[94,776,774],{},[152,778,780],{"id":779},"shodan-queries",[75,781,782],{},"Shodan Queries",[87,784,787],{"code":785,"language":786,"meta":91,"className":92,"style":91},"hostname:targetname.com\ncontent-type: application\u002Fjson\ncontent-type: application\u002Fxml\n200 OK\nwp-json\n","http",[94,788,789,798,806,813,819],{},[97,790,791,795],{"class":99,"line":100},[97,792,794],{"class":793},"sR8n-","hostname:",[97,796,797],{"class":107},"targetname.com\n",[97,799,800,803],{"class":99,"line":118},[97,801,802],{"class":793},"content-type:",[97,804,805],{"class":107}," application\u002Fjson\n",[97,807,808,810],{"class":99,"line":130},[97,809,802],{"class":793},[97,811,812],{"class":107}," application\u002Fxml\n",[97,814,815],{"class":99,"line":521},[97,816,818],{"class":817},"sG2Fq","200 OK\n",[97,820,821],{"class":99,"line":721},[97,822,823],{"class":817},"wp-json\n",[152,825,827],{"id":826},"wayback-machine",[75,828,829],{},"Wayback Machine",[44,831,832],{},"Compare older API documentation for differences in endpoints. Test old endpoints during active testing.",[59,834,836],{"id":835},"_2-active-reconnaissance","2. Active Reconnaissance",[152,838,840],{"id":839},"nmap",[75,841,842],{},"Nmap",[87,844,846],{"code":845,"language":90,"meta":91,"className":92,"style":91},"nmap -sC -sV \u003Ctarget> -oA output.txt\nnmap -p- \u003Ctarget> -oA output-allports.txt\nnmap -sV --script=http-enum \u003Ctarget> -p 80,443,8000,8080\n",[94,847,848,877,897],{},[97,849,850,852,855,858,862,865,868,871,874],{"class":99,"line":100},[97,851,839],{"class":103},[97,853,854],{"class":114}," -sC",[97,856,857],{"class":114}," -sV",[97,859,861],{"class":860},"sfIIG"," \u003C",[97,863,864],{"class":107},"targe",[97,866,867],{"class":817},"t",[97,869,870],{"class":860},">",[97,872,873],{"class":114}," -oA",[97,875,876],{"class":107}," output.txt\n",[97,878,879,881,884,886,888,890,892,894],{"class":99,"line":118},[97,880,839],{"class":103},[97,882,883],{"class":114}," -p-",[97,885,861],{"class":860},[97,887,864],{"class":107},[97,889,867],{"class":817},[97,891,870],{"class":860},[97,893,873],{"class":114},[97,895,896],{"class":107}," output-allports.txt\n",[97,898,899,901,903,906,908,910,912,914,917],{"class":99,"line":130},[97,900,839],{"class":103},[97,902,857],{"class":114},[97,904,905],{"class":114}," --script=http-enum",[97,907,861],{"class":860},[97,909,864],{"class":107},[97,911,867],{"class":817},[97,913,870],{"class":860},[97,915,916],{"class":114}," -p",[97,918,919],{"class":107}," 80,443,8000,8080\n",[152,921,923],{"id":922},"amass",[75,924,925],{},"Amass",[87,927,929],{"code":928,"language":90,"meta":91,"className":92,"style":91},"amass enum -active -d \u003Ctarget>\n",[94,930,931],{},[97,932,933,935,938,941,944,946,948,950],{"class":99,"line":100},[97,934,922],{"class":103},[97,936,937],{"class":107}," enum",[97,939,940],{"class":114}," -active",[97,942,943],{"class":114}," -d",[97,945,861],{"class":860},[97,947,864],{"class":107},[97,949,867],{"class":817},[97,951,952],{"class":860},">\n",[152,954,956],{"id":955},"directory-brute-force",[75,957,958],{},"Directory Brute-force",[195,960,961,991],{},[198,962,963,966],{},[75,964,965],{},"Gobuster:",[87,967,969],{"code":968,"language":90,"meta":91,"className":92,"style":91},"gobuster dir -u http:\u002F\u002Ftarget-name.com:8000 -w \u002Fusr\u002Fshare\u002Fdirb\u002Fcommon.txt\n",[94,970,971],{},[97,972,973,976,979,982,985,988],{"class":99,"line":100},[97,974,975],{"class":103},"gobuster",[97,977,978],{"class":107}," dir",[97,980,981],{"class":114}," -u",[97,983,984],{"class":107}," http:\u002F\u002Ftarget-name.com:8000",[97,986,987],{"class":114}," -w",[97,989,990],{"class":107}," \u002Fusr\u002Fshare\u002Fdirb\u002Fcommon.txt\n",[198,992,993,996],{},[75,994,995],{},"ffuf:",[87,997,999],{"code":998,"language":90,"meta":91,"className":92,"style":91},"ffuf -u http:\u002F\u002Ftarget\u002FFUZZ -w \u002Fusr\u002Fshare\u002Fdirb\u002Fcommon.txt\n",[94,1000,1001],{},[97,1002,1003,1006,1008,1011,1013],{"class":99,"line":100},[97,1004,1005],{"class":103},"ffuf",[97,1007,981],{"class":114},[97,1009,1010],{"class":107}," http:\u002F\u002Ftarget\u002FFUZZ",[97,1012,987],{"class":114},[97,1014,990],{"class":107},[152,1016,1018],{"id":1017},"devtools-in-browser",[75,1019,1020],{},"DevTools in Browser",[195,1022,1023],{},[198,1024,1025,1026,1029,1030,1033],{},"Open DevTools with ",[94,1027,1028],{},"F12"," or ",[94,1031,1032],{},"Ctrl+Shift+I"," to inspect requests, check for API calls, and examine responses.",[51,1035],{},[54,1037,1039],{"id":1038},"conclusion","Conclusion",[44,1041,1042],{},"With your environment fully set up, you’re now ready to dive into the world of API hacking. From configuring Kali Linux and installing critical tools to creating an ideal hacking lab, every step brings you closer to a smooth and effective penetration testing experience. Remember, a good setup not only streamlines your process but also enhances the depth and accuracy of your testing.",[44,1044,1045],{},"Stay tuned for future guides that delve deeper into API exploitation techniques, common vulnerabilities, and advanced testing tools. If you found this guide helpful and want more, leave a comment with your thoughts. Until then, keep your skills sharp, stay curious, and happy hacking!",[1047,1048,1049],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .s6_DI, html code.shiki .s6_DI{--shiki-default:#B8A965;--shiki-light:#998418}html pre.shiki code .sfIIG, html code.shiki .sfIIG{--shiki-default:#CB7676;--shiki-light:#AB5959}html pre.shiki code .sG2Fq, html code.shiki .sG2Fq{--shiki-default:#DBD7CAEE;--shiki-light:#393A34}html pre.shiki code .sR8n-, html code.shiki .sR8n-{--shiki-default:#4D9375;--shiki-light:#1E754F}",{"title":91,"searchDepth":130,"depth":130,"links":1051},[1052,1074,1077,1091],{"id":56,"depth":118,"text":57,"children":1053},[1054,1055,1056,1057,1071],{"id":61,"depth":130,"text":62},{"id":81,"depth":130,"text":82},{"id":142,"depth":130,"text":143},{"id":149,"depth":130,"text":150,"children":1058},[1059,1060,1061,1062,1063,1064,1065,1066,1067,1068,1069,1070],{"id":154,"depth":521,"text":155},{"id":192,"depth":521,"text":193},{"id":269,"depth":521,"text":272},{"id":297,"depth":521,"text":300},{"id":330,"depth":521,"text":333},{"id":392,"depth":521,"text":395},{"id":415,"depth":521,"text":418},{"id":437,"depth":521,"text":440},{"id":462,"depth":521,"text":463},{"id":482,"depth":521,"text":485},{"id":541,"depth":521,"text":544},{"id":597,"depth":521,"text":600},{"id":623,"depth":130,"text":624,"children":1072},[1073],{"id":627,"depth":521,"text":630},{"id":651,"depth":118,"text":652,"children":1075},[1076],{"id":655,"depth":521,"text":658},{"id":748,"depth":118,"text":749,"children":1078},[1079,1085],{"id":752,"depth":130,"text":753,"children":1080},[1081,1082,1083,1084],{"id":756,"depth":521,"text":759},{"id":768,"depth":521,"text":771},{"id":779,"depth":521,"text":782},{"id":826,"depth":521,"text":829},{"id":835,"depth":130,"text":836,"children":1086},[1087,1088,1089,1090],{"id":839,"depth":521,"text":842},{"id":922,"depth":521,"text":925},{"id":955,"depth":521,"text":958},{"id":1017,"depth":521,"text":1020},{"id":1038,"depth":118,"text":1039},[1093,1094],"Bug Bounty","Penetration Testing","\u002Fimages\u002Fblog\u002Fapi-penetration-testing-pt1\u002Fapi-penetration-testing.webp","2024-11-14","Building an API penetration testing environment: Kali Linux, Burp Suite, OWASP ZAP, FoxyProxy and labs built for finding hidden API endpoints.","md",{},"\u002Fapi-penetration-testing-pt1",null,{"title":35,"description":1097},"api-penetration-testing-pt1","2025-02-05","BIH87d6219ArgY0D8d8S5izf7QDeIpXOrMdLQbG3d-c",{"older":1107,"newer":1112,"total":1117},{"slug":1108,"title":1109,"date":1110,"position":1111},"fuzz-everything","FUZZ Everything! 📂","2024-11-02",39,{"slug":1113,"title":1114,"date":1115,"position":1116},"api-penetration-testing-pt2","API Penetration Testing🔐 Part 2","2024-12-11",37,68,{"id":42,"title":35,"published":1119,"url":1120,"description":1121,"durationSeconds":1122,"viewCount":1123,"thumbnail":1124,"thumbnailSrcset":1125},"2024-11-19T14:00:40Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=ZPrDyLyuWYI","🔍 Ready to dive into API hacking? This video guides you through setting up the ultimate API penetration testing environment—from installing Kali Linux to configuring tools, hacking labs, and mastering passive and active reconnaissance.",2565,21683,"\u002Fimages\u002Fvideos\u002FZPrDyLyuWYI-800.webp","\u002Fimages\u002Fvideos\u002FZPrDyLyuWYI-800.webp 800w, \u002Fimages\u002Fvideos\u002FZPrDyLyuWYI-1280.webp 1280w",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":1127},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941257819]