Summary

Corey Ball, a cybersecurity consulting manager with a decade in penetration testing, wrote this as a hands-on course in breaking REST and GraphQL APIs rather than a general web security survey. It works through reconnaissance and endpoint discovery with tools like Kiterunner and OWASP Amass, then into vulnerabilities specific to APIs: BOLA and BFLA (broken object- and function-level authorization), mass assignment, injection, and authentication flaws, the same weaknesses behind a large share of API bug bounty payouts. The premise is that understanding these attacks well enough to execute them is what lets you design authorization checks that actually hold, rather than ones that only look complete on a diagram.

Target Readers

• Developers designing API authorization who want to understand BOLA and mass assignment from the attacker's side before they ship
• Security engineers moving from web application penetration testing into API-specific testing tools and techniques
• Bug bounty hunters targeting API endpoints who need a structured methodology, not just a list of vulnerability names

Colophon

Publisher

オライリー・ジャパン

ISBN

978-4-8144-0024-9

Published

Mar 2023

List price

¥4,400incl. taxMay differ from the actual selling price on Amazon