Path 21: API Security — KashSec Academy

APIs are the real backend of almost every modern app — the OWASP API Top 10, BOLA/BFLA, JWT attacks, GraphQL security, and a hands-on capstone lab against a real vulnerable API. 24 free lessons, advanced level, starting with "Why API Security Matters"

Level: Advanced · 24 lessons · Free, no account needed.

Lessons in this path

  1. Why API Security Matters — APIs are the real backend now — and where most real-world breaches actually happen.
  2. Real-World API Breach Case Studies — How the checklist categories actually played out in real incidents.
  3. What are APIs and why do they matter for security? — The contract behind almost everything modern software does.
  4. API Versioning & Shadow APIs — What accumulates in the gaps as an API evolves over time.
  5. OWASP API Top 10 (2023) — The shared checklist for API risk, ten categories at a glance.
  6. API Security Standards & Frameworks — ASVS, NIST, and industry regulations layered on top of OWASP.
  7. Authentication & Authorization in APIs — Who are you vs. what are you allowed to do — the distinction that matters most.
  8. OAuth2 & OIDC, Deep Dive — The delegation protocol behind most real-world API authentication.
  9. Broken Authentication & JWT Attacks — alg:none, algorithm confusion, and weak secrets — how tokens get forged.
  10. API Key & Secret Management — Where keys actually leak, and why rotation matters.
  11. BOLA & BFLA — the two most common API authorization failures — Object-level and function-level authorization, the #1 real-world API risk.
  12. Webhook Security — Authenticating inbound requests you didn't initiate.
  13. Mass Assignment & Excessive Data Exposure — When the API accepts — or returns — more than it should.
  14. API Gateway Security — Centralizing defense — and the risk of trusting it too much.
  15. Rate Limiting, Injection & Resource Abuse — SSRF, classic injection, and business-logic abuse when limits are missing.
  16. WebSocket Security — Persistent connections break the usual request-response assumptions.
  17. REST vs GraphQL — security differences that matter — Same goals, different attack surface — one endpoint changes everything.
  18. gRPC & Protobuf Security — Binary, schema-defined messages need a genuinely different testing approach.
  19. GraphQL Security — Introspection, nested queries, and field-level authorization.
  20. GraphQL Authorization Patterns — How field-level authorization actually gets implemented — and where it breaks.
  21. How to actually test APIs — A battle-tested recon-to-report workflow for bug bounty and pentests.
  22. API Documentation & Postman Workflows — Collections, environments, and automating checks with Newman.
  23. API Security Capstone Lab — Put it all together against a real vulnerable API — crAPI, vAPI, or your own.
  24. Your API Security Roadmap — Where to go next, and how to keep growing this specialisation.