๐ก ๐จ ๐ก ๐จ ๐ก ๐จ ๐ก ๐จ
Since the release of Hacking APIs, I've wanted to create a way for you to demonstrate your API hacking skills to yourself and to others. I'd like to introduce you to the API Security Certified Professional (ASCP)!
I received my first print copy of Hacking APIs and it feels amazing to hold something that took so much hard work. To celebrate, I wanted to share a few fun facts about Hacking APIs.
Hacking APIs Book Giveaway sponsored by ! We are giving away 10 print books.
One entry per:
โฅ๏ธ Like ๐ RT
๐Bonus entry to anyone who follows
@apisec_ai
. Ends in 48 hours!
The
@NahamSec
Hacking APIs book giveaway!
Giving out 10 signed print copies and I'll ship them anywhere ๐๐๐
One entry per:
โฅ๏ธ Like ๐ RT
Ends in 48 hours!
Don't want to wait? Pick up a copy over
@nostarch
.
Hacking APIs Book Giveaway for APIsecU!
10 Signed Physical Books (shipping to anywhere๐)
Entry for every:
โค๏ธLike
๐RT
๐Bonus Entry for Enrolling @
(Yes, if you already enrolled you are entered!)
Winners will be posted Friday!
Celebrating over 15K students on , so
time for another Hacking APIs Giveaway!
10 Signed Books (shipping anywhere๐)
Entry for every:
โค๏ธLike
๐RT
๐Bonus Entry for Following
@apisec_ai
All 10 Twitter winners will be posted Monday!
It's been incredible to see the number of sign ups for the API Penetration Testing course on APIsecU (). We just crossed over 30K students and 500 students have earned certificates of completion! One epic step toward preventing API-related data breaches.
I'm excited to announce the official release of the APIsec University: API Penetration Testing course (). You can now take the entire hands-on API hacking course and earn a Certificate of Completion for FREE. ๐งต
@hashishrajan
@davidbombal
@colindomoney
Hacking APIs Book Giveaway for APIsecU!
10 Print Books (shipping to anywhere๐)
Entry for every:
โค๏ธLike
๐RT
๐Bonus Entry for following
@apisecu
(If you already follow, you are entered!)
Winners will be posted Monday (3/6)!
@danbarahona
@apisec_ai
Your Uber driver tells you that it is destiny that you got in their car because they just decided to get into cybersecurity. They hand you their phone and ask you to list the best places to learn about cybersecurity.
What would be on your list?
@RealTryHackMe
@Hacker0x01
I will be running a
@RedTeamVillage_
Hacking APIs Workshop
@defcon
. I plan to guide attendees from zero to hAPI hacker in under 2 hours- let's go!
Put it on your
#HackerSummerCamp
calendars for:
August 12 3:00 PM - 5:00 PM PT
August 13 2:00 PM - 4:00 PM
๐ป๐ฅ๐
Finding and signing your book in your favorite bookstore (
@Powells
) is a great experience! Happy New Year!
May 2023 bring you many bounties, exciting new knowledge, and unpredictable epic adventures. โ๏ธ
Today is the official retail release of Hacking APIs!
๐ฅณ๐ป๐๐คฏ
If you are so inclined, pleeeeease leave a review at Amazon or Barnes&Noble! If you happen to see it in a store, I would love to see pics... as there are none near me.
The Hacking APIs cover art came to me in a dream. I woke at 3 AM and began scribbling details about
@elonmusk
's space roadster flying away from an exploding death star.
Despite spending over a couple of thousand hours writing the book since December 2019, 2 out of 3 of my daughters were surprised to find out today that I wrote this book.
The twist to the cover art was that
@nostarch
only wanted me to send the artist a single sentence. I went with, "An astronaut flying a roadster away from an exploding death star."
Gina Redman absolutely nailed it.
๐๐ฅ ๐๐ผ๐ Off the
@nostarch
Press: "๐๐น๐ฎ๐ฐ๐ธ ๐๐ฎ๐ ๐๐ฟ๐ฎ๐ฝ๐ต๐ค๐" ๐ฏ๐
@dolevfarhi
&
@Nick_Aleks
!
I just received my copy! Not only did the authors write the book, but they also designed the tools, and even created the lab that will get your hands on the keyboard! ๐ฅ๏ธ
Everyone interested in API security should grab this book ASAP.
@Nick_Aleks
and
@dolevfarhi
have authored the best resource for anyone looking to test GraphQL for vulnerabilities. Not only did Aleks and Farhi write the book, but they also created the vulnerable application used
Huzzah! One of spring's most anticipated books, Black Hat GraphQL (by
@dolevfarhi
&
@Nick_Aleks
) arrived ahead of sked and is now shipping. Called "an essential resource" for dev or sec practitioners, learn to use GraphQL as a hacking tool, ID bugs, & more:
I was set on the title from Day 1. Moss Adams partner Kevin Villanueva voluntold me to become the API pentest expert on the team. I searched on for "Hacking APIs". I was blown away to find no results. I immediately created a doc named Hacking APIs.
Just in case anyone was wondering,
@davidbombal
and his amazing editing team stole my โฅ๏ธ with the Free API Hacking Course: Death Star intro. ๐๐งโ๐๐ฉโ๐๐ฅ
The art only took two sketches. The main dif from the 1st to the 2nd was the astronaut was fearful of the explosion, I thought instead they should be proud of their successful mission. The astronaut represents the hAPI hacker that any reader of Hacking APIs can become.
Introducing the Certified API Security Analyst (CASA) certification!
Earning the CASA cert demonstrates:
-A strong understanding of the OWASP API Security Top Ten ๐ช
-The ability to identify API Security Vulns๐
-An understanding of how to prevent API-related attacks ๐ก
๐งต
๐จ***** New Free Course Alert *****๐จ
OWASP API Security Top 10 andย Beyond!
I have created a new
@apisecu
course that dives into the latest updates to the OWASP API Security Top Ten (2023) and discusses other significant security considerations beyond the top ten. As APIs are a
The OWASP API Security Top 10 is a key reference for learning about the current top security vulnerabilities.
It can help you understand - and protect against - threats to your apps.
This course walks you through the current list along with mitigations.
The final Hacking APIs workshops
@defcon
are today! Out at
@RedTeamVillage_
2-3 PM PT
3-4 PM
Workshop Goals:
1. Discover APIs
2. Reverse Engineer a Collection
3. Exploit:
Excessive Data Exposure and
Broken Object Level Authorization
I just found out that I'll be one of the keynote speakers next week at APIsecure 2023! I will be talking about
#APIfirst
Hacking. There's a wide range of excellent API security topics that involve breaking, building, and protecting APIs. Don't
Hacking APIs SANS DMA Book of the Year Finalist!
I appreciate everyone taking the time to vote and everyone who helped get Hacking APIs on the list to begin with!
#SANSDMA
Great time talking with
@Steph3nSims
and
@ChrisADale
about API Hacking!!! Chris put on a live masterclass of how to fuzz APIs for injection vulnerabilities.
It was ๐ฅ
๐๐๐
Chatting with Corey Ball (
@hAPI_Hacker
) and Dan Barahona (
@danbarahona
) on all things API hacking, with love for Corey's FREE APISEC University course, his book, and some sweet stories from his time pentesting APIs!
The
@NahamSec
Hacking APIs book giveaway!
Giving out 10 signed print copies and I'll ship them anywhere ๐๐๐
One entry per:
โฅ๏ธ Like ๐ RT
Ends in 48 hours!
Don't want to wait? Pick up a copy over
@nostarch
.
APIsecure 2023 Closing Keynote Slides! As expected, an amazing API Security conference with a ton of great content. Special thanks to
@alissaknight
, Baptiste Paravicini, and
@medjawii
!
Iโll be speaking about API First Hacking at APIsecure 2023. At this virtual API Security virtual conference there will be over 80 speakers, a Red Track, Blue Track, and Solutions Track.
Inspired by
@hAPI_hacker
and his book "Hacking APIs" I made a
@zaproxy
script to help you build
@getpostman
collections from requests in your ZAP history log.
Maybe it will help you with your
#API
testing too.
#AppSec
@apisecu
has released its second FREE course, API Security Fundamentals! Created by
@danbarahona
and covers the governance, testing, and monitoring of APIs. Check it out!
This month, Iโll be giving away 5 exam vouchers, each worth $650.
Iโll pick winners from my Twitter and LinkedIn so stay glued to know when I announce and what the rules will be.
No DMs please.
Hacking APIs is sold out! But I have a not-so-secret stash. I am signing and selling the remaining books at no additional cost. Only 25 copies are left.
Heads up! 25% off deal over at Barnes and Noble for all pre-orders including Hacking APIs running through 4/22 (tomorrow!). Use the code: PREORDER25. I think this is currently the best deal out there to pick up a copy.
@apisecu
has released its second FREE course, API Security Fundamentals! Created by
@danbarahona
and covers the governance, testing, and monitoring of APIs. Check it out! (Link in thread).
API Kitchenโs first episode is now live on YouTubeโฆ.yippee
Click the link below to watch the full episode on my YouTube channel and donโt forget to subscribe and share the video.
I will be out at
@BsidesSLC
on 4/15 putting on a workshop called, "Start Hacking APIs". After that
@Moss_Adams
is sponsoring a 50-book giveaway live at the conference! I will be there signing and handing out books after the workshop. ๐๐๐
We just kicked off a new
@Humble
Bundle ebook partnership for the holidays! Pay what you want for up to 18 of our bestselling hacking and security titlesโplus, your purchase benefits
@ncacensorship
and their fight against book banning.
Next week I will be out at
@BSidesKnoxville
doing a book launch for Hacking APIs. I will be joining
@C_3PJoe
who will be launching his
@nostarch
book, Practical Social Engineering. There will surely be books, signings, and good conversations.
Having a blast out at
@APIdaysGlobal
Paris! I just finished a
@Moss_Adams
giveaway of Hacking APIs. This was the eighth giveaway this year and by far the fastest the books went. Tomorrow Iโm the keynote speaker for the
@apisecu
track and I took the perfect cover photo of the
APIs drive
#DigitalTransformation
within our companies and all around us. At Postman, we're thrilled to announce Postmanโs first book authored by our Chief Evangelist, Kin Lane, "The API First Transformation Book." ๐
Get your copy today:
May your API hacking experience be filled with prosperous bounties, critical vulnerability findings, brilliant exploitation, and detailed reports! ๐งต
Take the course, pass the quizzes+assessments, and you will be awarded a Credly badge to demonstrate your hard work. I hope this free course can help us better defend the world's APIs and prevent the next great data breaches. ๐งต
I'll be speaking out at APIdays New York!
@Moss_Adams
will be sponsoring another giveaway of Hacking APIs (x50 books)! ๐๐๐
You can sign up using the link below.
Hacking APIs, a book I have been working on for the last two years, is now live at ! This book is a crash course on attacking web APIs. It is meant to help you learn how to hack the APIs to make the world a safer place. More to come in the near future!
Our Hacking Humble ebook Bundle Starts NOW! Pay what you want for up to 18 of our bestselling hacking and security titlesโplus, your purchase benefits
@EFF
and their fight against censorship.
Good news! I talked with
@apisec_ai
and they have decided to sponsor another Hacking APIs book giveaway over on LinkedIn.
Announcement coming later today. ๐๐๐
I have been working as a technical editor with
@Nick_Aleks
and
@dolevfarhi
on their upcoming book Black Hat GraphQL. This book is amazing! Not only do they demonstrate how to attack GraphQL APIs, but they also developed the best tools available for testing.
#graphql
#blackhat
Incredibly excited to announce that the Black Hat GraphQL book I co-authored with
@Nick_Aleks
is available on the No Starch Press website for pre order. Use the code PREORDER to get 25% off.
@LogicalError403
All recommendations can be found at under Your API Hacking Lab module.
Check out:
@RealTryHackMe
Bookstore (free)
IDOR ($)
GraphQL ($)
@hackthebox_eu
(Retired)
Craft, JSON, Luke
Github (Vulnerable Apps)
@InsiderPhD
/Generic-University
erev0s /vAmPI
๐๐ Exciting news! On the latest episode of WE'RE IN! I'm the guest speaker, sharing insights and knowledge about
#APIsecurity
. We talk about my favorite API vulnerability, why generic security scanners canโt detect most API security flaws, and the future of API security. ๐งต
Today is the day!
#Postbot
at
@getpostman
is officially in Open Beta!!!!
Postbot can help you create:
- single test script generation for requests
- test suite generation for collections
You can read more here:
#AI
#Postman
Need a last-minute gift for mom? (Or just feel like treating yourself to something new?) Shop our Mother's Day Sale! Everything's 25% off site-wide from now through Sunday night w'/ coupon code MOM25:
The ASCP is a 12-hour practical assessment of your ability to test two API-driven web applications for security weaknesses and then exploit those vulnerabilities. Each application has four key vulnerabilities that you'll need to find, exploit, and report on.
@TommyTenacious
@apisec_ai
That being said... Every retweet also makes the awesome people over
@apisec_ai
want to do more giveaways. Then when there is the next round, there may be 10 fewer competitors ๐ค๐งฎ๐
Are you curious about how your GraphQL implementation compares to others from a security perspective? Check out to research the differences in security features, vulnerabilities and request validations across multiple GraphQL implementations.
I had a blast speaking to
@bendee983
over at The
@DailySwig
about API security. Vulnerability management programs miss out on effectively testing APIs for vulnerabilities. This leaves a crucial gap in many enterprise security programs.
At
@Moss_Adams
, I help lead the pentest