#owasp-api-security-top-10

TCH

DA David Banjo

Breaking JSON Web Tokens: My Hunt for the “alg:none” Vulnerability in crAPI

Part 1 of a 2-part series on JWT attacks against crAPI [Read part 2 here]

Jul 10, 2026 · 4 min read · 0 claps #api #api-testing #crapi

TCH HUM

AH Ahmed Ali

BOLA(Broken Object Level Authorization)

Broken Object Level Authorization (BOLA) is a critical API security vulnerability ranked API1 in the OWASP API Security Top 10. It occurs…

Jun 25, 2026 · 3 min read · 1 claps #api #api-pentesting #owasp-api-security-top-10

TCH AI

JA Jatin yadav

I Learned API Penetration Testing in 4 Hours. Here’s What Actually Matters.

Most API security guides teach concepts. This one teaches how to think like an attacker.

Jun 23, 2026 · 5 min read · 4 claps #api-penetration-testing #pentesting #owasp-api-security-top-10

TCH AI

JO johnnattakit 0xDD

GraphQL Introspection: The Feature That Hands Attackers Your API Blueprint

TL;DR: GraphQL introspection is a built-in, spec-compliant feature that — when left enabled on production endpoints — gives attackers a…

Jun 03, 2026 · 6 min read · 0 claps #cybersecurity #owasp-api-security-top-10 #graphql

TCH HUM

UR Ursullazeking

My First Time Learning OWASP Juice Shop and Burp Suite (Beginner-Friendly Guide)

When I first opened OWASP Juice Shop and Burp Suite, I honestly had no idea what I was looking at.

May 29, 2026 · 4 min read · 1 claps #owasp-api-security-top-10 #burpsuite #owasp-top-10

OG Ogbonna Divine C.

Bypassing the Vault: How SQLi, BOLA, BOPLA and PCI DSS Failures Broke a Vuln-bank API

This is the final post in my vuln-bank series. Over the past four weeks I have worked through recon, JWT attacks, rate limiting, and PIN…

May 27, 2026 · 8 min read · 0 claps #api #api-security #owasp-api-security-top-10

ART TCH ECO

AN Anniebhee

Threat Modeling a Mobile Banking API Architecture: From STRIDE Analysis to Fraud and Business Risk

Modern banking platforms increasingly rely on APIs to power authentication, transactions, fraud analysis, notifications, and customer…

May 25, 2026 · 5 min read · 0 claps #cybersecurity #grc #owasp-api-security-top-10

TCH

AB Abdullahbinzarshaid

I Found a Way to Access Company Data Without Logging In

By Abdullah Bin Zarshaid

May 20, 2026 · 5 min read · 0 claps #cybersecurity #owasp-api-security-top-10 #web-penetration-testing

HUM ECO

BO Boluwatife Dada

OWASP crAPI Walkthrough Series

Broken Object Level Authorization (BOLA) — API 1:2023

May 19, 2026 · 4 min read · 3 claps #crapi #api-security #owasp-api-security-top-10

HUM

SA Sana Jalil · InfoSec Write-ups

Broken Authentication: How Attackers Gain Unauthorized Access to Your Application.

Introduction: Why Broken Authentication Still Wins

May 16, 2026 · 6 min read · 13 claps #broken-authentication #api-penetration-testing #bug-bounty

TCH

SH Shubhomrawat

Beyond XSS and SQLi: Why Business Logic Is the Real Frontier of Web Security Testing

What a week of hands-on API testing taught me about thinking like an attacker, not just scanning like a tool

May 15, 2026 · 4 min read · 1 claps #owasp-api-security-top-10 #web-application-security #cybersecurity

KA Kaylen Stuart

Unsafe Consumption of APIs — A Novice Explorer’s Guide for Testers

This article is part of a beginner-friendly API security testing series inspired by the OWASP API Security Top 10, written from the…

May 14, 2026 · 5 min read · 0 claps paywalled #owasp #owasp-api-security-top-10 #qa-testing

KA Kaylen Stuart

Broken Authentication — A Novice Explorer’s Guide for Testers

Photo by RDNE Stock project: https://www.pexels.com/photo/id-s-on-the-table-7648020/

May 09, 2026 · 5 min read · 0 claps paywalled #owasp #owasp-api-security-top-10 #qa-testing

KR Krutika

Security Misconfiguration in VAmPI and crAPI

One of the common vulnerabilities in API security is Security Misconfiguration. It is categorized as API8: Security Misconfiguration in the…

May 05, 2026 · 4 min read · 0 claps #security-misconfiguration #owasp-api-security-top-10 #vampi

KR Krutika

Unsafe Consumption of APIs in VAmPI and crAPI

One of the important vulnerabilities in API security is Unsafe Consumption of APIs. It is categorized as API10: Unsafe Consumption of APIs…

May 03, 2026 · 3 min read · 0 claps #owasp-api-security-top-10 #web-api-security #crapi

TCH

KR Krutika

SERVER-SIDE REQUEST FORGERY (SSRF) in crAPI

One of the dangerous vulnerabilities in API security is Server-Side Request Forgery (SSRF). It is categorized as API7: Server Side Request…

May 01, 2026 · 3 min read · 11 claps #crapi #owasp-api-security-top-10 #ssrf

DSN

PE Peace Dennis

vAPI Lab Walkthrough

This post is a walkthrough for vAPI, a deliberately vulnerable app designed for practicing API security.

Apr 14, 2026 · 20 min read · 51 claps #vapi #api-security-testing #ctf-walkthrough

ECO

KR Krutika

IMPROPER INVENTORY MANAGEMENT in crAPI

One of the often overlooked vulnerabilities in API security is Improper Inventory Management. It is categorized as API9: Improper Inventory…

Apr 12, 2026 · 3 min read · 1 claps #crapi #owasp-api-security-top-10 #api-security

HUM

KR Krutika

BROKEN FUNCTION LEVEL AUTHORIZATION (BFLA) in VAmPI and crAPI

One of the critical vulnerabilities in API security is Broken Function Level Authorization (BFLA). It is categorized as API5: Broken…

Apr 09, 2026 · 4 min read · 1 claps #authorization #bfla #crapi

KR Krutika

BROKEN AUTHENTICATION in VAmPI and crAPI

One of the most critical vulnerabilities in API security is Broken Authentication. It is categorized as API2: Broken Authentication in the…

Apr 04, 2026 · 3 min read · 1 claps #authentication #broken-authentication #vampi

HUM

KR Krutika

BROKEN OBJECT PROPERTY LEVEL AUTHORIZATION (BOPLA) in VAmPI and crAPI

One of the critical vulnerabilities in API security is Broken Object Property Level Authorization (BOPLA). It is ranked as API3: Broken…

Mar 09, 2026 · 4 min read · 2 claps #bopla #api-security #owasp-api-security-top-10

HUM

KR Krutika

Broken Object Level Authorization (BOLA) Vulnerabilities in crAPI

One of the most critical vulnerabilities in API security is Broken Object Level Authorization (BOLA). It is ranked as API1: Broken Object…

Mar 05, 2026 · 3 min read · 2 claps #bola #crapi #api-vapt

TCH SOC

IS Iseoluwa Ogunnaike

Why Real API Breaches Happen Through Chains, Not Single Bugs

Most real-world API breaches do not occur because of one dramatic vulnerability. They happen because small weaknesses connect. One flaw…

Mar 02, 2026 · 2 min read · 0 claps #api #owasp-api-security-top-10 #bola

TCH ECO

MA Madalitso Cheyo

A Hands-On Security Assessment of VAmPI

APIs power modern applications; from mobile banking to e-commerce and internal enterprise systems. But while APIs enable seamless…

Feb 20, 2026 · 7 min read · 51 claps #api-security #owasp-api-security-top-10 #vampi

ST Stella Obatoye

API Security for Connected Cars and Fleets: My CyberSafe Training Experience (Week 8)

Introduction

Jan 29, 2026 · 3 min read · 221 claps #api-security #owasp-api-security-top-10 #connected-cars

BU Burak Akdogan

Akamai Noname — Kong Gateway Entegrasyonu ile API Güvenliğini Güçlendirmek

Modern uygulama mimarilerinde API’ler vazgeçilmez hale geldi. Ancak API’lerin yaygınlaşmasıyla birlikte güvenlik riskleri de katlanarak…

Jan 08, 2026 · 4 min read · 8 claps #security #api #akamai

TCH HUM

AP Apifort

🔐API1:2023 — Broken Object Level Authorization

API’ler modern yazılım mimarilerinin merkezinde yer alır. Mikroservis yapıları, mobil uygulamalar ve üçüncü taraf entegrasyonlar sayesinde…

Dec 15, 2025 · 3 min read · 1 claps #api-security #apifort #cybersecurity

TCH MDA ECO SPT

UK Ukwedje Taiwo Goodness

API Security 101: How Modern Systems Get Hacked

As we all know, APIs run the modern world. Every mobile app, fintech dashboard, school portal, travel platform, and e-commerce tool relies…

Dec 05, 2025 · 3 min read · 1 claps #api-security #owasp-api-security-top-10 #cybersecurity-awareness

TCH

AP Apifort

API10:2023 — Unsafe Consumption of APIs

Üçüncü Taraf API’lere Körü Körüne Güvenmek Ne Kadar Tehlikeli?

Oct 07, 2025 · 4 min read · 1 claps #unsafe-consumption #api-security #owasp-api-security-top-10

ECO TCH

AP Apifort

🔍 API9:2023 — Improper Inventory Management

API Güvenliğinde Envanter Yönetiminin Kritik Rolü

Sep 23, 2025 · 2 min read · 2 claps #api-security #owasp-api-security-top-10 #apifort

TCH

AP Apifort

🔐 API8:2023 — Security Misconfiguration: Yanlış Yapılandırmalar API Güvenliğini Nasıl Tehlikeye…

API’ler günümüz dijital mimarilerinin merkezinde yer alan en kritik bileşenlerdir. Artık yalnızca veri aktarımı için kullanılan bir…

Sep 08, 2025 · 3 min read · 50 claps #api-security #owasp-api-security-top-10 #security-misconfiguration

TCH

AP Apifort

🚨API7:2023 — Server-Side Request Forgery: API’yi İç Sistemlere Köprü Olarak Kullanmak

1. Giriş

Sep 02, 2025 · 2 min read · 51 claps #owasp-api-security-top-10 #ssrf #cybersecurity

TCH

AP Apifort

🚨API6:2023 — Unrestricted Access to Sensitive Business Flows

1. Giriş

Aug 26, 2025 · 3 min read · 50 claps #api-security #owasp-api-security-top-10 #business-flow

TCH HUM

AP Apifort

API 5:2023 — Broken Function Level Authorization 🔓: Unseen Authorizations, Critical Threats

API’ler, dijital dönüşümün hızlandığı günümüzde yazılım sistemlerinin fonksiyonlarını dış dünyaya açan en kritik bileşenler haline geldi…

Aug 13, 2025 · 2 min read · 0 claps #api #api-security #owasp-api-security-top-10

TCH

AP Apifort

API4:2023 — Unrestricted Resource Consumption

⚡ Kaynakların Kontrolsüz Tüketimi ve API Güvenliğinde Kritik Riskler

Aug 08, 2025 · 3 min read · 50 claps #api #api-security #owasp-api-security-top-10

TCH HUM

AP Apifort

API3:2023 — Broken Object Property Level Authorization

Bir kullanıcı sadece kendi bilgilerini görmeli… ama arka plandaki API ona yöneticilerin rollerini ve gizli sistem etiketlerini de veriyor…

Jul 16, 2025 · 1 min read · 0 claps #api #api-security #owasp-api-security-top-10

DE DevcopMe

Leading API Security Vendors to Watch

Based on industry-recognized resources, below are the top 10 API security vendors in 2025:

Jul 11, 2025 · 1 min read · 0 claps #api-security #owasp-api-security-top-10 #web-api-security

TCH HUM

SO Sourabh Pradhan

API: Broken Function Level Authorization

Hey everyone! Welcome to my seventh blog post! Today, we’re going to explore a crucial vulnerability from the OWASP API Top 10 — Broken…

Dec 24, 2024 · 2 min read · 52 claps #api-security #owasp-top-10 #owasp-api-security-top-10

AB Abhishek Tamang

API Security Testing : An Overview by Abhishek Tamang

Introduction

Mar 31, 2024 · 7 min read · 0 claps #api-security #api-security-testing #api

IN Indusface

API4:2019 — Lack of Resources & Rate Limiting: The What, Sample Exploit, and Prevention Methods

Lack of resources & rate limiting is #4 on the OWASP Top 10 API Security Risks 2019. It is a prevalent API security risk. As per OWASP…

Oct 20, 2023 · 8 min read · 2 claps #api-attack #api-security #owasp-api-security-top-10

TCH HUM

SH Shivam Bathla · Pentester Academy Blog

API5:2019 — Broken Function Level Auth II

Hello all, today we will be looking into OWASP API Security Top 10’s another vulnerability, i.e. Broken Function Level Authorization.

Jul 29, 2020 · 8 min read · 0 claps #rest-api #api-security #web-application-security