When will I receive my Course Certificate?

If you complete the course successfully, your electronic Course Certificate will be added to your Accomplishments page - from there, you can print your Course Certificate or add it to your LinkedIn profile.

Why can’t I audit this course?

This course is currently available only to learners who have paid or received financial aid, when available.

Is financial aid available?

Yes. In select learning programs, you can apply for financial aid or a scholarship if you can’t afford the enrollment fee. If fin aid or scholarship is available for your learning program selection, you’ll find a link to apply on the description page.

Pentesting APIs

Pentesting APIs

Instructor: Packt - Course Instructors

Included with

Learn more

10 modules

Gain insight into a topic and learn the fundamentals.

Intermediate level

Recommended experience

3 weeks to complete

at 10 hours a week

Flexible schedule

Learn at your own pace

10 modules

Gain insight into a topic and learn the fundamentals.

Intermediate level

Recommended experience

3 weeks to complete

at 10 hours a week

Flexible schedule

Learn at your own pace

What you'll learn

Understand the role of APIs in modern applications and their security challenges
Set up a penetration testing environment for API security testing
Identify and exploit common API vulnerabilities through practical techniques

Skills you'll gain

Tools you'll learn

Details to know

Shareable certificate

Add to your LinkedIn profile

See how employees at top companies are mastering in-demand skills

Learn more about Coursera for Business

logos of Petrobras, TATA, Danone, Capgemini, P&G and L'Oreal

There are 10 modules in this course

This course provides learners with the essential skills to secure APIs against evolving cyber threats. You will master real-world techniques for discovering vulnerabilities, fingerprinting, and exploiting APIs to identify weaknesses and implement effective security measures. API security is critical in today’s digital world, where APIs are core components of modern applications.

You will learn how to set up an environment for penetration testing, assess API security, and apply expert techniques to protect APIs from common threats. Practical exercises focus on real-world scenarios, equipping you with the skills to proactively defend APIs against exploitation. The course stands out by combining theory with hands-on practice, offering a comprehensive guide to identifying, testing, and securing APIs. You’ll explore vulnerabilities in both RESTful and GraphQL APIs, gaining expert insights into real-world cybersecurity challenges. This course is ideal for security engineers, developers, and analysts with a basic understanding of web development and cybersecurity. It’s designed for those looking to enhance their skills in API security and protection.

In this section, we explore APIs, their types, protocols, and security principles, emphasizing their role in system integration and the risks of poor security practices.

What's included

2 videos6 readings1 assignment

In this section, we guide the setup of a secure penetration testing environment, focusing on tool selection, lab configuration, and repository usage for practical API testing.

What's included

1 video4 readings1 assignment

In this section, we explore API reconnaissance techniques, including enumeration, OSINT, and analyzing documentation to identify vulnerabilities and improve security practices.

What's included

1 video5 readings1 assignment

1 videoTotal 1 minute

API Reconnaissance and Information Gathering - Overview Video1 minute

5 readingsTotal 140 minutes

Introduction30 minutes
Looking at crAPI30 minutes
Analyzing API Documentation and Endpoints30 minutes
Leveraging OSINT20 minutes
Identifying Data and Schema Structures30 minutes

1 assignmentTotal 10 minutes

API Security and Information Gathering Fundamentals10 minutes

In this section, we cover API authentication and authorization testing, including weak credentials and access control issues.

What's included

1 video9 readings1 assignment

1 videoTotal 1 minute

Authentication and Authorization Testing - Overview Video1 minute

9 readingsTotal 210 minutes

Introduction20 minutes
Basic Authentication20 minutes
Session Tokens30 minutes
JSON Web Tokens (JWTs)30 minutes
Testing for Weak Credentials and Default Accounts20 minutes
Common Credentials and Default Accounts20 minutes
Exploring Authorization Mechanisms20 minutes
Attribute-based Access Control20 minutes
Bypassing Access Controls30 minutes

1 assignmentTotal 10 minutes

Authentication and Authorization Fundamentals10 minutes

In this section, we explore injection vulnerabilities, testing SQL and NoSQL injection, and validating user input to enhance API security and prevent data breaches.

What's included

1 video8 readings1 assignment

1 videoTotal 1 minute

Injection Attacks and Validation Testing - Overview Video1 minute

8 readingsTotal 210 minutes

Introduction30 minutes
Testing for SQL Injection30 minutes
Hidden Union SQL Injection30 minutes
Exploiting SQL Injection on a Vulnerable API30 minutes
Testing for NoSQL Injection20 minutes
Operator Injection30 minutes
Validating and Sanitizing User Input20 minutes
Sanitizing Query Parameters20 minutes

1 assignmentTotal 10 minutes

Injection Attacks and Input Validation10 minutes

In this section, we explore error handling in APIs, focusing on identifying error codes, fuzzing for vulnerabilities, and leveraging error responses for infrastructure analysis.

What's included

1 video3 readings1 assignment

In this section, we explore testing for DoS vulnerabilities, identifying rate-limiting mechanisms, and evaluating their effectiveness to enhance API resilience against malicious traffic.

What's included

1 video7 readings1 assignment

1 videoTotal 1 minute

Denial of Service and Rate-Limiting Testing - Overview Video1 minute

7 readingsTotal 200 minutes

Introduction30 minutes
Interacting with Mockoon’s Endpoints30 minutes
Leveraging Scapy to Attack Mockoon20 minutes
Sending Fragmented Packets with hping330 minutes
Identifying Rate-Limiting Mechanisms30 minutes
Leaky Buckets30 minutes
Circumventing Rate Limitations30 minutes

1 assignmentTotal 10 minutes

API Security and Traffic Control10 minutes

In this section, we explore identifying sensitive data exposure, testing for information leakage, and implementing prevention strategies in APIs to enhance security and reduce vulnerabilities.

What's included

1 video5 readings1 assignment

In this section, we examine API abuse and business logic testing, focusing on identifying vulnerabilities, simulating abuse scenarios, and implementing security measures to prevent exploitation.

What's included

1 video7 readings1 assignment

1 videoTotal 1 minute

API Abuse and Business Logic Testing - Overview Video1 minute

7 readingsTotal 190 minutes

Introduction30 minutes
Exploring API Abuse Scenarios30 minutes
Setting Up OpenBullet220 minutes
Creating a Configuration and Attacking30 minutes
Other Features and Security Recommendations30 minutes
Parameter Tampering30 minutes
Testing for Business Logic Vulnerabilities20 minutes

1 assignmentTotal 10 minutes

Exploring API Security and Business Logic Risks10 minutes

In this section, we explore secure coding practices for APIs, focusing on authentication, input validation, and encryption to prevent vulnerabilities and ensure data integrity.

What's included

1 video3 readings1 assignment

Instructor

Packt - Course Instructors

Packt

1,893 Courses527,426 learners

Offered by

Packt

Explore more from Software Development

Edureka
Protecting and Managing APIs
Course
Coursera
API Testing a real web application via Postman
Guided Project
Coursera
Building API Test Automation Framework Using Rest Assured
Guided Project
EDUCBA
Apply API Testing Fundamentals Using Postman
Course

Why people choose Coursera for their career

Felipe M.

Learner since 2018

"To be able to take courses at my own pace and rhythm has been an amazing experience. I can learn whenever it fits my schedule and mood."

Jennifer J.

Learner since 2020

"I directly applied the concepts and skills I learned from my courses to an exciting new project at work."

Larry W.

Learner since 2021

"When I need courses on topics that my university doesn't offer, Coursera is one of the best places to go."

Chaitanya A.

"Learning isn't just about being better at your job: it's so much more than that. Coursera allows me to learn without limits."

Unlock access to 10,000+ courses with a subscription
Advance your career with an online degree
Earn a degree from world-class universities - 100% online
Join over 4,700 global companies that choose Coursera for Business

Frequently asked questions

Yes, you can preview the first video and view the syllabus before you enroll. You must purchase the course to access content not included in the preview.

If you decide to enroll in the course before the session start date, you will have access to all of the lecture videos and readings for the course. You’ll be able to submit assignments once the session starts.

Once you enroll and your session begins, you will have access to all videos and other resources, including reading items and the course discussion forum. You’ll be able to view and submit practice assessments, and complete required graded assignments to earn a grade and a Course Certificate.

Pentesting APIs

Pentesting APIs

What you'll learn

Skills you'll gain

Tools you'll learn

Details to know

See how employees at top companies are mastering in-demand skills

There are 10 modules in this course

Understanding APIs and Their Security Landscape

What's included

Setting Up the Penetration Testing Environment

What's included

API Reconnaissance and Information Gathering

What's included

Authentication and Authorization Testing

What's included

Injection Attacks and Validation Testing

What's included

Error Handling and Exception Testing

What's included

Denial of Service and Rate-Limiting Testing

What's included

Data Exposure and Sensitive Information Leakage

What's included

API Abuse and Business Logic Testing

What's included

Secure Coding Practices for APIs

What's included

Instructor

Offered by

Explore more from Software Development

Protecting and Managing APIs

API Testing a real web application via Postman

Building API Test Automation Framework Using Rest Assured

Apply API Testing Fundamentals Using Postman

Why people choose Coursera for their career

Felipe M.

Jennifer J.

Larry W.

Chaitanya A.

Unlock access to 10,000+ courses with a subscription

Advance your career with an online degree

Join over 4,700 global companies that choose Coursera for Business

Frequently asked questions

Can I preview a course before enrolling?

When will I have access to the lectures and assignments?

What will I get when I enroll?

More questions