APIs

Testing REST and GraphQL APIs: authentication, access control, and API-specific attack surface.

Start here: GraphQL Penetration Testing - Complete Guide11 notes

API 02: Exploitation - JWT VulnerabilityJanuary 30, 2026API 02: Exploitation - JWT Vulnerability · from Anas-Magane/Pentesting (APIs Testing Security).
API 03: JWT Cracking - Weak Secret KeyJanuary 30, 2026API 03: JWT Cracking - Weak Secret Key · from Anas-Magane/Pentesting (APIs Testing Security).
API 04: HTTP Verb TamperingJanuary 30, 2026When I checked the proxy, there were no interesting API calls being made.
API 05: Minified JavaScript AnalysisJanuary 30, 2026Everything is squeezed together with no spaces or line breaks!
API 06 – CSRF Bypass Write-upJanuary 30, 2026The goal is to retrieve the secret key from the protected endpoint /get secret .
API Penetration Test Notes: IDOR DiscoveryJanuary 30, 2026API Penetration Test Notes: IDOR Discovery · from Anas-Magane/Pentesting (APIs Testing Security).

GraphQL