[{"data":1,"prerenderedAt":699},["ShallowReactive",2],{"announcement":3,"i-tabler:sun":11,"i-tabler:moon":16,"i-tabler:menu-2":18,"i-tabler:x":20,"i-simple-icons:youtube":22,"i-simple-icons:github":24,"i-simple-icons:x":26,"i-simple-icons:linkedin":28,"i-tabler:arrow-up-right":31,"post-api-penetration-testing-pt2":33,"post-nav-api-penetration-testing-pt2":676,"video-api-penetration-testing-pt2":688,"i-tabler:copy":697},{"startsAt":4,"endsAt":5,"scramble":6,"cta":7,"message":10},"2026-10-13","2026-11-30","Cache Poisoning:",{"href":8,"label":9},"\u002Fcache-poisoning-the-cache-you-cant-purge","Read it","The cache you can't purge.",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":15},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":17},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":19},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":21},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":23},"\u003Cpath fill=\"currentColor\" d=\"M23.498 6.186a3.02 3.02 0 0 0-2.122-2.136C19.505 3.545 12 3.545 12 3.545s-7.505 0-9.377.505A3.02 3.02 0 0 0 .502 6.186C0 8.07 0 12 0 12s0 3.93.502 5.814a3.02 3.02 0 0 0 2.122 2.136c1.871.505 9.376.505 9.376.505s7.505 0 9.377-.505a3.02 3.02 0 0 0 2.122-2.136C24 15.93 24 12 24 12s0-3.93-.502-5.814M9.545 15.568V8.432L15.818 12z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":25},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":27},"\u003Cpath fill=\"currentColor\" d=\"M14.234 10.162L22.977 0h-2.072l-7.591 8.824L7.251 0H.258l9.168 13.343L.258 24H2.33l8.016-9.318L16.749 24h6.993zm-2.837 3.299l-.929-1.329L3.076 1.56h3.182l5.965 8.532l.929 1.329l7.754 11.09h-3.182z\"\u002F>",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":29,"hidden":30},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":32},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M17 7L7 17M8 7h9v9\"\u002F>",{"id":34,"title":35,"body":36,"categories":661,"coverImage":665,"date":666,"description":667,"draft":14,"extension":668,"meta":669,"navigation":30,"noindex":14,"path":670,"readingTime":671,"seo":672,"slug":673,"stem":673,"updatedAt":674,"youtubeId":42,"__hash__":675},"blog\u002Fapi-penetration-testing-pt2.md","API Penetration Testing🔐 Part 2",{"type":37,"value":38,"toc":637},"minimark",[39,43,52,59,62,69,72,79,82,131,137,140,248,250,256,259,277,284,298,300,306,312,315,329,334,349,355,358,384,386,392,398,401,462,472,478,481,486,488,494,500,503,508,511,517,520,525,528,530,536,543,616,619,621,627,630,633],[40,41],"post-media",{"video":42},"x6ZN02G3CeE",[44,45,46,47,51],"p",{},"In our ",[48,49,50],"strong",{},"previous article",", we introduced API hacking, focusing on reverse engineering, scanning for vulnerabilities, and hands-on testing without fluff or distractions. Your response to that guide was overwhelming, and many of you asked for more. So, welcome to part two, where we’ll dive even deeper into API reverse engineering, identifying vulnerabilities, and exploiting them.",[44,53,54,55,58],{},"This guide is for those who want to elevate their API testing skills, offering step-by-step explanations and practical demonstrations. If you haven’t read part one yet, check it out ",[48,56,57],{},"here"," to build a solid foundation.",[60,61],"hr",{},[63,64,66],"h2",{"id":65},"reverse-engineering-an-api",[48,67,68],{},"Reverse Engineering an API",[44,70,71],{},"When dealing with undocumented APIs, reverse engineering is the key to understanding how they work. This process involves capturing and analyzing requests to map out the API endpoints and their functionality. Here are two methods you can use:",[73,74,76],"h3",{"id":75},"_1-building-a-collection-in-postman",[48,77,78],{},"1. Building a Collection in Postman",[44,80,81],{},"Postman is a powerful tool for collecting, organizing, and testing API requests. Follow these steps to reverse engineer an API:",[83,84,85,96,115,125],"ol",{},[86,87,88,91,92,95],"li",{},[48,89,90],{},"Launch Postman",": Open Postman and set up a dedicated workspace for your project. For instance, create an ",[48,93,94],{},"ACE Workspace"," to save collections.",[86,97,98,101,102,105,106,110,111,114],{},[48,99,100],{},"Enable the Proxy",": Use the ",[48,103,104],{},"Capture Requests"," feature in Postman. Set the proxy to port ",[107,108,109],"code",{},"5555"," and the target URL to ",[107,112,113],{},"http:\u002F\u002F127.0.0.1:8888",".",[86,116,117,120,121,124],{},[48,118,119],{},"Use FoxyProxy for Traffic Redirection",": Configure your browser with FoxyProxy to route traffic through Postman’s proxy. Start interacting with the ",[48,122,123],{},"crAPI","web application (register, login, upload data, etc.).",[86,126,127,130],{},[48,128,129],{},"Capture and Save Requests",": As you interact with the API, Postman captures the requests. Save these requests into a collection, categorizing them by endpoints for efficient testing.",[73,132,134],{"id":133},"_2-automating-documentation-with-mitmproxy2swagger",[48,135,136],{},"2. Automating Documentation with mitmproxy2swagger",[44,138,139],{},"To automate the process, mitmproxy2swagger converts captured traffic into a Swagger API specification:",[83,141,142,156,166,176,221,242],{},[86,143,144,147,148],{},[48,145,146],{},"Run mitmweb",": Start mitmweb to capture traffic:",[149,150,154],"pre",{"code":151,"language":152,"meta":153},"mitmweb\n","text","",[107,155,151],{},[86,157,158,161,162,165],{},[48,159,160],{},"Set Up Proxy",": Route traffic through mitmproxy using FoxyProxy (",[107,163,164],{},"http:\u002F\u002F127.0.0.1:8080",").",[86,167,168,171,172,175],{},[48,169,170],{},"Capture Traffic",": Interact with the API, saving captured requests as a ",[107,173,174],{},"flows"," file.",[86,177,178,181,182],{},[48,179,180],{},"Generate Swagger File",": Convert the captured traffic into a Swagger API specification:",[149,183,187],{"code":184,"language":185,"meta":153,"className":186,"style":153},"sudo mitmproxy2swagger -i \u002FDownloads\u002Fflows -o spec.yml -p http:\u002F\u002F127.0.0.1:8888\n","bash","shiki shiki-themes vitesse-dark vitesse-light",[107,188,189],{},[190,191,194,198,202,206,209,212,215,218],"span",{"class":192,"line":193},"line",1,[190,195,197],{"class":196},"swzfi","sudo",[190,199,201],{"class":200},"sRRDT"," mitmproxy2swagger",[190,203,205],{"class":204},"se4ZP"," -i",[190,207,208],{"class":200}," \u002FDownloads\u002Fflows",[190,210,211],{"class":204}," -o",[190,213,214],{"class":200}," spec.yml",[190,216,217],{"class":204}," -p",[190,219,220],{"class":200}," http:\u002F\u002F127.0.0.1:8888\n",[86,222,223,226,227,230,231,114],{},[48,224,225],{},"Edit and Validate",": Edit the generated ",[107,228,229],{},"spec.yml"," file to include any ignored endpoints and validate it using ",[232,233,239],"a",{"href":234,"rel":235,"target":238},"https:\u002F\u002Feditor.swagger.io\u002F?utm_source=amrelsagaei.com&utm_medium=referral",[236,237],"noopener","noreferrer","_blank",[48,240,241],{},"Swagger Editor",[86,243,244,247],{},[48,245,246],{},"Import into Postman",": Import the Swagger file into Postman for further testing and exploitation.",[60,249],{},[63,251,253],{"id":252},"excessive-data-exposure",[48,254,255],{},"Excessive Data Exposure",[44,257,258],{},"One common API vulnerability is excessive data exposure, where endpoints return unnecessary or sensitive information. For example:",[260,261,262,271],"ul",{},[86,263,264,267,268],{},[48,265,266],{},"Endpoint",": ",[107,269,270],{},"GET \u002Fcommunity\u002Fapi\u002Fv2\u002Fcommunity\u002Fposts\u002Frecent",[86,272,273,276],{},[48,274,275],{},"Data Returned",": User IDs, email addresses, and other sensitive details that attackers can exploit.",[73,278,280,283],{"id":279},"how-to-detect-and-exploit",[48,281,282],{},"How to Detect and Exploit",":",[83,285,286,292],{},[86,287,288,291],{},[48,289,290],{},"Review Responses",": Use tools like Postman or Burp Suite to inspect API responses for sensitive data.",[86,293,294,297],{},[48,295,296],{},"Verify Exploitability",": Test if the exposed data can be used to gain unauthorized access or perform further attacks.",[60,299],{},[63,301,303],{"id":302},"scanning-apis-for-weaknesses",[48,304,305],{},"Scanning APIs for Weaknesses",[73,307,309],{"id":308},"nikto",[48,310,311],{},"Nikto",[44,313,314],{},"Nikto provides a quick overview of server misconfigurations and missing headers:",[149,316,318],{"code":317,"language":185,"meta":153,"className":186,"style":153},"nikto -h http:\u002F\u002F127.0.0.1:8888\n",[107,319,320],{},[190,321,322,324,327],{"class":192,"line":193},[190,323,308],{"class":196},[190,325,326],{"class":204}," -h",[190,328,220],{"class":200},[44,330,331,283],{},[48,332,333],{},"Common Findings",[260,335,336,346],{},[86,337,338,339,342,343,165],{},"Missing security headers (",[107,340,341],{},"X-Frame-Options",", ",[107,344,345],{},"X-XSS-Protection",[86,347,348],{},"Server platform details, such as OpenResty, which may aid attackers in identifying potential vulnerabilities.",[73,350,352],{"id":351},"owasp-zap",[48,353,354],{},"OWASP ZAP",[44,356,357],{},"OWASP ZAP allows for both automated and manual scans to identify deeper issues:",[83,359,360,366,372,378],{},[86,361,362,365],{},[48,363,364],{},"Import API Specification",": Use the Swagger file to define the scope of the scan.",[86,367,368,371],{},[48,369,370],{},"Unauthenticated Scans",": Run active scans to detect public vulnerabilities like Injection or Security Misconfigurations.",[86,373,374,377],{},[48,375,376],{},"Authenticated Scans",": Log in to the app and interact with it while ZAP captures requests. Enable ZAP HUD for live analysis.",[86,379,380,383],{},[48,381,382],{},"Review Results",": Focus on high-risk issues, such as Injection vulnerabilities, found in the results.",[60,385],{},[63,387,389],{"id":388},"authentication-attacks",[48,390,391],{},"Authentication Attacks",[73,393,395],{"id":394},"_1-brute-forcing-passwords",[48,396,397],{},"1. Brute-Forcing Passwords",[44,399,400],{},"Brute-force attacks test multiple password combinations to crack accounts. Tools like WFuzz simplify this process:",[149,402,404],{"code":403,"language":185,"meta":153,"className":186,"style":153},"wfuzz -d '{email:user@email.com,password:FUZZ}' \\\n      -H 'Content-Type: application\u002Fjson' \\\n      -z file,\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt \\\n      -u http:\u002F\u002F127.0.0.1:8888\u002Fidentity\u002Fapi\u002Fauth\u002Flogin\n",[107,405,406,427,442,453],{},[190,407,408,411,414,418,421,424],{"class":192,"line":193},[190,409,410],{"class":196},"wfuzz",[190,412,413],{"class":204}," -d",[190,415,417],{"class":416},"sy_C3"," '",[190,419,420],{"class":200},"{email:user@email.com,password:FUZZ}",[190,422,423],{"class":416},"'",[190,425,426],{"class":204}," \\\n",[190,428,430,433,435,438,440],{"class":192,"line":429},2,[190,431,432],{"class":204},"      -H",[190,434,417],{"class":416},[190,436,437],{"class":200},"Content-Type: application\u002Fjson",[190,439,423],{"class":416},[190,441,426],{"class":204},[190,443,445,448,451],{"class":192,"line":444},3,[190,446,447],{"class":204},"      -z",[190,449,450],{"class":200}," file,\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt",[190,452,426],{"class":204},[190,454,456,459],{"class":192,"line":455},4,[190,457,458],{"class":204},"      -u",[190,460,461],{"class":200}," http:\u002F\u002F127.0.0.1:8888\u002Fidentity\u002Fapi\u002Fauth\u002Flogin\n",[44,463,464,467,468,471],{},[48,465,466],{},"Expected Result",": Successful attempts return a ",[107,469,470],{},"200 OK"," response.",[73,473,475],{"id":474},"_2-password-spraying",[48,476,477],{},"2. Password Spraying",[44,479,480],{},"Password spraying tests a limited set of passwords across multiple accounts to avoid triggering lockouts. Use Burp Suite’s Intruder with payloads like:",[149,482,484],{"code":483,"language":152,"meta":153},"Sun@2003!\nHarverd@2024\n",[107,485,483],{},[60,487],{},[63,489,491],{"id":490},"authorization-vulnerabilities",[48,492,493],{},"Authorization Vulnerabilities",[73,495,497],{"id":496},"_1-broken-object-level-authorization-bola",[48,498,499],{},"1. Broken Object Level Authorization (BOLA)",[44,501,502],{},"Test if endpoints allow unauthorized access by manipulating resource IDs:",[149,504,506],{"code":505,"language":152,"meta":153},"GET \u002Fidentity\u002Fapi\u002Fv2\u002Fvehicle\u002F{resourceID}\u002Flocation\n",[107,507,505],{},[44,509,510],{},"A successful attempt exposes sensitive user data like GPS coordinates.",[73,512,514],{"id":513},"_2-broken-function-level-authorization-bfla",[48,515,516],{},"2. Broken Function Level Authorization (BFLA)",[44,518,519],{},"Test if users can escalate privileges by modifying endpoint paths:",[149,521,523],{"code":522,"language":152,"meta":153},"DELETE \u002Fidentity\u002Fapi\u002Fv2\u002Fadmin\u002Fvideos\u002F75\n",[107,524,522],{},[44,526,527],{},"If the request succeeds, it indicates insufficient role validation.",[60,529],{},[63,531,533],{"id":532},"improper-asset-management",[48,534,535],{},"Improper Asset Management",[44,537,538,539,542],{},"Older API versions often have weaker security. For example, ",[107,540,541],{},"\u002Fcheck-otp"," has two versions:",[83,544,545,557],{},[86,546,547,550,553,556],{},[48,548,549],{},"Version 3 (",[107,551,552],{},"\u002Fv3",[48,554,555],{},")",": Limits OTP attempts and blocks brute-force attacks.",[86,558,559,562,565,567,568],{},[48,560,561],{},"Version 2 (",[107,563,564],{},"\u002Fv2",[48,566,555],{},": Lacks rate-limiting, enabling brute-forcing:",[149,569,571],{"code":570,"language":185,"meta":153,"className":186,"style":153},"wfuzz -d '{otp:FUZZ}' \\\n      -H 'Content-Type: application\u002Fjson' \\\n      -z file,\u002Fusr\u002Fshare\u002Fwordlists\u002F4-digits.txt \\\n      -u http:\u002F\u002F127.0.0.1:8888\u002Fv2\u002Fcheck-otp\n",[107,572,573,588,600,609],{},[190,574,575,577,579,581,584,586],{"class":192,"line":193},[190,576,410],{"class":196},[190,578,413],{"class":204},[190,580,417],{"class":416},[190,582,583],{"class":200},"{otp:FUZZ}",[190,585,423],{"class":416},[190,587,426],{"class":204},[190,589,590,592,594,596,598],{"class":192,"line":429},[190,591,432],{"class":204},[190,593,417],{"class":416},[190,595,437],{"class":200},[190,597,423],{"class":416},[190,599,426],{"class":204},[190,601,602,604,607],{"class":192,"line":444},[190,603,447],{"class":204},[190,605,606],{"class":200}," file,\u002Fusr\u002Fshare\u002Fwordlists\u002F4-digits.txt",[190,608,426],{"class":204},[190,610,611,613],{"class":192,"line":455},[190,612,458],{"class":204},[190,614,615],{"class":200}," http:\u002F\u002F127.0.0.1:8888\u002Fv2\u002Fcheck-otp\n",[44,617,618],{},"In this scenario, attackers can brute-force the OTP and reset passwords.",[60,620],{},[63,622,624],{"id":623},"conclusion",[48,625,626],{},"Conclusion",[44,628,629],{},"This second part built on the foundational skills we explored in part one, diving deeper into API security testing techniques. From reverse engineering to detecting vulnerabilities and performing targeted attacks, this guide equips you with actionable methods to enhance your API hacking skills. Stay tuned for the next part, where we’ll explore advanced token abuse techniques and bypassing security mechanisms.",[44,631,632],{},"Keep learning, stay curious, and, as always, stay secure!",[634,635,636],"style",{},"html pre.shiki code .swzfi, html code.shiki .swzfi{--shiki-default:#80A665;--shiki-light:#59873A}html pre.shiki code .sRRDT, html code.shiki .sRRDT{--shiki-default:#C98A7D;--shiki-light:#B56959}html pre.shiki code .se4ZP, html code.shiki .se4ZP{--shiki-default:#C99076;--shiki-light:#A65E2B}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html pre.shiki code .sy_C3, html code.shiki .sy_C3{--shiki-default:#C98A7D77;--shiki-light:#B5695977}",{"title":153,"searchDepth":444,"depth":444,"links":638},[639,643,647,651,655,659,660],{"id":65,"depth":429,"text":68,"children":640},[641,642],{"id":75,"depth":444,"text":78},{"id":133,"depth":444,"text":136},{"id":252,"depth":429,"text":255,"children":644},[645],{"id":279,"depth":444,"text":646},"How to Detect and Exploit:",{"id":302,"depth":429,"text":305,"children":648},[649,650],{"id":308,"depth":444,"text":311},{"id":351,"depth":444,"text":354},{"id":388,"depth":429,"text":391,"children":652},[653,654],{"id":394,"depth":444,"text":397},{"id":474,"depth":444,"text":477},{"id":490,"depth":429,"text":493,"children":656},[657,658],{"id":496,"depth":444,"text":499},{"id":513,"depth":444,"text":516},{"id":532,"depth":429,"text":535},{"id":623,"depth":429,"text":626},[662,663,664],"Bug Bounty","Linux","Penetration Testing","\u002Fimages\u002Fblog\u002Fapi-penetration-testing-pt2\u002Fapi-penetration-testing-pt2.webp","2024-12-11","Reverse engineering APIs with Postman and mitmproxy2swagger, finding excessive data exposure, and scanning for weaknesses. Part two of API testing.","md",{},"\u002Fapi-penetration-testing-pt2",null,{"title":35,"description":667},"api-penetration-testing-pt2","2025-02-05","ZUZOhrJBVj6F6IC8ORmWj8rKLbPxLMW6seOVwkO5UKU",{"older":677,"newer":682,"total":687},{"slug":678,"title":679,"date":680,"position":681},"api-penetration-testing-pt1","API Penetration Testing 🔐","2024-11-14",38,{"slug":683,"title":684,"date":685,"position":686},"bug-bounty-hunting-methodology-2025","Bug Bounty Hunting Methodology 2025","2025-01-01",36,68,{"id":42,"title":689,"published":690,"url":691,"description":692,"durationSeconds":693,"viewCount":694,"thumbnail":695,"thumbnailSrcset":696},"API Penetration Testing 🔐 Part 2","2024-12-13T13:01:08Z","https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=x6ZN02G3CeE","🔍 Ready for API Hacking Part 2? In this video, we take your API penetration testing skills to the next level. From reverse engineering undocumented APIs to discovering vulnerabilities like excessive data exposure, authentication flaws, and authorization bypasses, this hands-on guide dives deeper into the world of API…",3191,5732,"\u002Fimages\u002Fvideos\u002Fx6ZN02G3CeE-800.webp","\u002Fimages\u002Fvideos\u002Fx6ZN02G3CeE-800.webp 800w, \u002Fimages\u002Fvideos\u002Fx6ZN02G3CeE-1280.webp 1280w",{"left":12,"top":12,"width":13,"height":13,"rotate":12,"vFlip":14,"hFlip":14,"body":698},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M7 9.667A2.667 2.667 0 0 1 9.667 7h8.666A2.667 2.667 0 0 1 21 9.667v8.666A2.667 2.667 0 0 1 18.333 21H9.667A2.667 2.667 0 0 1 7 18.333z\"\u002F>\u003Cpath d=\"M4.012 16.737A2 2 0 0 1 3 15V5c0-1.1.9-2 2-2h10c.75 0 1.158.385 1.5 1\"\u002F>\u003C\u002Fg>",1791941257705]