Free lesson 1 of 7 from API Security — The OWASP API Top 10 hands-on: BOLA, broken JWT auth, mass assignment — on a real live API.. No account, no card.
Mobile apps, SPAs and microservices all talk over JSON APIs — and APIs fail differently from web pages. The OWASP API Security Top 10 is dominated by authorization bugs: the server exposes objects and actions it should have locked down. You'll hunt them on a live API.
curl -s "http://10.0.0.7/?p=api&e=help" | jq .
Endpoints: user (fetch by id), login (get a JWT), vault (admin-only), signup. Your box has curl and jq.
help endpoint and list every route. Which ones take an id or a token — i.e. where authorization should happen?curl -s "http://10.0.0.7/?p=api&e=help" | jq .
user?id= (per-object → BOLA risk), vault (token → auth risk), signup (body → mass assignment). Three authorization surfaces, three bugs.
⚖️ Test only APIs you own or are authorized to (the lab, or in-scope programs).
7 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab
Unlock all courses · CHF 9/month Buy only this course · CHF 19