API-Web-Security

KO | EN

gitlite — search

#python #react #machine-learning #rust #deep-learning #macos #windows #awesome #cli #kubernetes #awesome-list #openai #mcp #open-source

API-Web-Security

(★ 27)

API Security University & PortSwigger Academy Study Notes

API-Web-Security Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# LLM - API - Web Application Security

>API Security University & PortSwigger Web Security Academy Study Notes

* [CASA - Certified API Security Analyst Exam](https://www.apisecuniversity.com/courses/certified-api-security-analyst-exam)  
* [ASCP - API Security Certified Professional Exam](https://www.apisecuniversity.com/courses/api-security-certified-professional-exam)  
* [ACP - APIsec Certified Practitioner](https://www.apisecuniversity.com/courses/apisec-certified-practitioner)  
* [BSCP - Burp Suite Certified Practitioner](https://github.com/botesjuan/Burp-Suite-Certified-Practitioner-Exam-Study)  
  
----

<br><br><a href="https://www.buymeacoffee.com/botesjuan" target="_blank"><img src="https://cdn.buymeacoffee.com/buttons/v2/default-yellow.png" alt="Buy Me A Coffee" style="height: 60px !important;width: 217px !important;" ></a>
>Thanks too all for your support by buying me ***coffee***, thank you so much `\o/`  
  
----

# APIsec Courses

## API Security Fundamentals 2025

* [API Security](/module/api-fundamentals.md)  
* [Intro OWASP API Security Top 10](/module/api-fundamentals.md)  
* [API Threat Modeling](/module/api-fundamentals.md)  
* [API Best Practices](/module/api-fundamentals.md)

## OWASP API Security Top 10 and Beyond

* [OWASP API Security Top 10](/module/OWASP-API-Security-Top-10.md)  
* [API1:2023 Broken Object Level Authorization](/module/bola.md)  
* [API2:2023 Broken Authentication](/module/Broken-Auth.md)  
* [API3:2023 Broken Object Property Level Authorization](/module/bopla.md)  
* [API4:2023 Unrestricted Resource Consumption](/module/rate-limit.md)  
* [API5:2023 Broken Function Level Authorization](/module/bfla.md)  
* [API6:2023 Unrestricted Access to Sensitive Business Flows](/module/business-flaws.md)  
* [API7:2023 Server Side Request Forgery](/module/ssrf.md)  
* [API8:2023 Security Misconfiguration](/module/misconfig.md)  
* [API9:2023 Improper Inventory Management](/module/bom.md)  
* [API10:2023 Unsafe Consumption of APIs](/module/consumption-of-api.md)  
* [Injection, Insufficient Logging and Monitoring & Business Logic Flaws](/module/Injection.md)

## API Authentication

* [Oauth Actors](/module/API-Authentication.md)  
* [OAuth 2.0 Interaction Patterns](/module/API-Authentication.md)  
* [Tokens](/module/API-Authentication.md)  
* [Scopes and Claims](/module/API-Authentication.md)  
* [APIs and Gateways](/module/API-Authentication.md)

## API Documentation Best Practices

* [API Documentation](/module/api_documentation.md)  
* [Business Impact of API Documentation](/module/api_documentation.md)    
* [How to Write Good Documentation](/module/api_documentation.md)    
* [Documentation Techniques and Tools](/module/api_documentation.md)    
* [Documentation Best Practices](/module/api_documentation.md)

## Securing API Servers

* Cross Origin Resource Sharing (CORS)  
* Error Disclosure  
* Information Leak  
* Insecure Cookies  
* Path Traversal  
* Rate Limits

## API Penetration Testing

* [API Lab Setup & Discovery](/module/API-Discovery.md)  
* [API Reconnaissance](/module/api-reconnaissance.md)  
* [Endpoint Analysis](/module/Endpoint-Analysis.md)  
* [Authentication Attacks](/module/Authentication-Attacks.md)  
* [Exploiting Authorization](/module/Exploiting-Authorization.md)  
* [Testing for Improper Assets Management](/module/Improper-Assets-Management.md)  
* [Mass Assignment](/module/mass-assignment.md)  
* [Exploiting SSRF](/module/exploiting-ssrf.md)  
* [Evasive Maneuvers](/module/evasive-maneuvers.md)
* [Injection Attacks & WAF Rate Limiting](/module/injection-attacks.md)  
* [Extra Additional Resources](/module/additional-resources.md)

----

## PortSwigger Web Security Academy

* [Exploiting LLM APIs](/module/api-llm.md)  
* [Race Conditions](/module/race-condition.md)  
* [No SQL - Mongo DB](/module/nosql.md)  
* [Web Cache Deception](/module/web_cache.md)  
* [LLM Web Attacks](/module/llm_web_attacks.md)

----

## References

* [CASA - 100 multiple choice questions Exam in 2 hours](https://www.apisecuniversity.com/courses/certified-api-security-analyst-exam)  
* [ASCP Practical 12 hours hands-on Exam](https://www.apisecuniversity.com/courses/api-security-certified-professional-exam)  
* [crAPI OWASP Solution Chalanges - walkthrough](https://github.com/OWASP/crAPI/blob/7ceb7fa890f5376fdccacc2346c9d2f32097c59f/docs/challengeSolutions.md)  
* [Roger's Blog on ASCP Exam attempts](https://blog.invid.eu/2024/07/16/what-do-i-think-of-passing-the-ascp-exam-from-apisec-university/)  
* [TCM Security - API Hacking Course by Alex Olsen](https://academy.tcm-sec.com/p/hacking-apis)  
* [HackTheBox Academy - API Attacks](https://academy.hackthebox.com/module/268/section/3059)

----

API-Web-Security

API-Web-Security Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

API-Web-Security

API-Web-Security Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README