Certified API Security Professional (CASP)TM
APIsec Course with Hands-on API Security Training

The API security training prepares you for the Certified API Security Professional (CASP) course, a vendor-neutral APIsec certification designed to assess an IT professional’s API security expertise.

This API security course imparts professionals with deep knowledge of API security, adopting modern security practices and automation to secure APIs with appropriate techniques, catching security issues before they become critical, and alerting relevant engineers in real-time.

Upon completion of this API security certification course, you will be able to:

Identify, exploit, and protect against a wide variety of API security vulnerabilities.
Gain a practical understanding of API Security and the tools for automation.
Understand and implement the modern ways of scaling API Security Testing.
Gain abilities to audit APIs for security measures and provide solutions.
Understand, assess, and secure APIs written in different architecture styles.
Learn new ways to secure APIs through automation, and DevSecOps practices.

Enroll Now

Top Rated Course

Check Out Reviews

Self-paced Learning Mode
Browser-based Lab Access
24/7 Instructor Support via Mattermost

API Security Training Prerequisites

Course participants should have a basic understanding of Linux Commands and OWASP Top 10.
Basic knowledge of application development is preferred but is not necessary.

Chapter 1: Introduction to API Security

Introduction to Application Programming Interface
1. What is an API?
2. Need for an API
3. Why Should You Secure Your APIs?
4. APIs vs. Web Applications
Understanding API Architecture
1. Overview of the HTTP protocol
  1. Anatomy of a HTTP Request
  2. Anatomy of a HTTP Response
  3. HTTP Response Codes and Its Significance
  4. Stateless and Stateful Requests
2. Overview of API architecture
  1. API Protocols
  2. API Data formats
  3. Different Types of APIs
3. Simple Architecture
  1. How Are APIs Typically Deployed?
4. Complex Architecture
Strategies To Secure APIs
1. Threat Modeling of APIs
2. Traditional VAPT vs API VAPT
API Defenses
1. Input Validation
2. Identification
3. Authentication
4. Authorization
5. Data Encryption
6. Transport Security
7. Error Handling and Logging
8. Supply Chain Security
Hands-on Exercises:
1. Understanding The Lab Setup
2. Working With Linux Command(s)
3. Working With Command Outputs
4. Working With Exit Code
5. Hosting Files Using HTTP Server

Chapter 2: API Security Tools of the trade

The Moving Parts in an API
1. API Gateway
2. Load Balancer/Reverse Proxy
3. Message Queues
Critical Toolchain for API Development
1. Source Code Management
2. CI/CD Tools
3. Artifact Management
4. Cloud Platform
5. Infrastructure as Code
6. Monitoring and Logging Tools
7. Collaboration Tools
Containerization
Ability To Talk to an API
1. cURL (curl)
2. Postman
3. OpenAPI (Swagger)
4. Python
5. An MITM Proxy
Hands-on Exercises:
1. Understanding an API Language (Endpoints, Verbs, and State)
2. Understanding cURL Command
3. Performing CRUD Operations Using API
4. Setup the Burp Suite for API Security Testing
5. Understanding APIs Using OpenAPI Specifications
6. Performing Reconnaissance on an API
7. Path And Directory Discovery Using FFUF
8. Enumerating User Accounts From an API

Chapter 3: Authentication Attacks and Defenses

Overview of API Authentication
Types of Authentication
1. No Authentication (Public APIs)
2. HTTP Basic Authentication
3. API Token Authentication
4. OIDC Authentication
5. JSON Web Tokens (JWTs)
6. SAML Tokens
7. Mutual TLS
Authentication Attacks
1. Brute Force
2. Weak Password Storage
3. Password Reset Workflows
4. Account Lockouts
5. Insecure OpenID Connect Configuration
6. Insecure JWTs Validation
Authentication Defenses
1. Secure Authentication Workflows
2. Strong Password and Key Validation
3. Multi-Factor Authentication
4. Securely Storing the Tokens
  1. Cookies
  2. Local Storage and Session Storage
  3. Token Storage and XSS
5. Rate Limiting
6. CAPTCHA
Hands-on Exercises:
1. Talking To An API Using OAuth and JWT
2. Talking To An API Using HTTP Basic and API Keys
3. Exploiting Broken Authentication With SQL Injection
4. Exploiting Broken Authentication With Weak Passwords
5. Cracking Weak Password Hashes With Dictionaries
6. Cracking Weak Password Hashes With Bruteforce And Combinations
7. Abusing JWT Tokens

Chapter 4: Authorization Attacks and Defenses

Overview of API Authorization
Types of Authorization
1. No Authorization
2. Role-Based Access Control (RBAC)
3. Discretionary Access Control (DAC)
4. Attribute-Based Access Control (ABAC)
5. Relationship-Based Access Control (ReBAC)
Authorization Attacks
1. Misconfigured Permissions
2. Broken Object Level Authorization
3. Broken Function Level Authorization
4. Horizontal Privilege Escalation
5. Vertical Privilege Escalation
Authorization Defenses
1. Defending Object & Function Level Access
2. Attribute-Based Access Control (ABAC) with Roles, and Relations
3. Decoupling Authorization Decisions With Policy As Code
Authorizing with OAuth Framework
1. OAuth Specification
2. Different Authorization Workflows
3. Insecure OAuth Configurations
4. OAuth 2.0 vs OAuth 2.1
5. Different Types of Tokens
  1. Access Token
  2. Refresh Token
  3. ID Token
Hands-on Exercises:
1. Forging JWT Tokens For Privilege Escalation
2. Finding Another Users Location Using BOLA

Chapter 5: Input validation Threats and Defenses

Introduction to Input Validation
1. Input Validation
2. Input Sanitization
Injection Vulnerabilities
1. Cross-Site Scripting (XSS)
2. SQL Injection
3. ORM Injection
4. NoSQL Injection
5. Server Side Request Forgery
6. Deserialization Issues
7. Mass Assignment Issues
Fuzzing
1. Fuzzing 101
2. Fuzzing vs Brute Forcing
3. Fuzzing APIs Using Open Source and Commercial Tools
  1. Burp Suite Intruder
  2. OWASP ZAP Fuzzer
  3. Wfuzz
  4. FFUF
Injection Defenses
1. Implementing Input Validation
2. Client-Side vs. Server-Side Validation
3. Whitelisting & Blacklisting
4. Implementing Input Sanitization
5. Validating With Regular Expressions
6. Output Encoding
  1. HTML Encoding
  2. HTML Attribute Encoding
  3. Javascript Encoding
  4. CSS Encoding
7. Prepared Statements
8. Content Security Policy
9. Trusted Types
Hands-on Exercises:
1. Getting Free Coupons Without Knowing Coupon Code
2. Exploiting Mass Assignment Vulnerabilities
3. Insecure Deserialization To Remote Code Execution
4. Preventing Insecure Deserialization In Java
5. Post Exploitation In APIs Through Reverse Shells
6. Automated SQL Injection Using SQLMAP
7. Learning To Validate Input With Regular Expressions
8. Preventing DOM XSS With Trusted Types
9. Attacking GraphQL APIs

Chapter 6: Other API Security Threats

Introduction to OWASP API Top 10
1. 1. Broken Object Level Authorization
  2. Broken Authentication
  3. Excessive Data Exposure
  4. Lack of Resources and Rate Limiting
  5. Broken Function Level Authorization
  6. Mass Assignment
  7. Security Misconfigurations
  8. Injection
  9. Improper Asset Management
  10. Insufficient Logging and Monitoring
  11. Broken Object Property Level Authorization
  12. Unrestricted Resource Consumption
  13. Unrestricted Access to Sensitive Business Flows
  14. Server Side Request Forgery
  15. Improper Inventory Management
  16. Unsafe Consumption of APIs
Attacking Caching Layers (Memcache, Proxies, etc.,)
Attacking GraphQL APIs
Attacking SOAP APIs
Abusing Micro-services, and REST APIs
Post Exploitation in the API World
Hands-on Exercises:
1. Privilege Escalation With Cross Site Scripting
2. Abusing CORS Misconfigurations

Chapter 7: Other API Security Defenses

GraphQL API Security Best Practices
SOAP API Security Best Practices
REST API Security Best Practices
Data Security
1. Encoding and Decoding
2. Escaping
3. Hashing
4. Encryption and Decryption
Securing Data at Rest Using Encryption
1. Storing Credentials for Service-to-Service Communication
2. Password Storage and Its Considerations
3. Picking a Secure Algorithm
Securing Data in Transit Using TLS
Rate Limiting Best Practices
Security Headers
1. X-XSS-Protection
2. HTTP Strict Transport Security (HSTS)
3. Cache-Control
4. X-Frame-Options
  1. X-Frame-Options vs frame-ancestors
5. Content Security Policy
  1. Implementing CSP at Scale
  2. Common Misconfigurations While Using CSP
6. Cross-Origin Resource Sharing (CORS)
  1. Cookie Based Implementations
  2. Token Based Implementations
Hands-on Exercises:
1. Adding Content Security Policy To Mitigate Cross Site Scripting
2. Implementing Rate Limiting With API Gateway
3. Securing HTTP Headers using Kong Gateway
4. Implementing Rate Limiting using API Key

Chapter 8: Implementing API Security Mechanisms

API Security Design Best Practices
Authentication Implementation
Authorization Implementation
1. Designing API Permissions
2. Designing OAuth Scopes
Rate-Limiting Implementation and Best Practices at Different Stages
1. Reverse Proxy
2. Load Balancer
3. API Gateways and WAFs
4. Request Throttling
Securely Store Secrets Using Hashicorp Vault
Data Security Implementation
Using Transport Layer Security (TLS)
Implementing Sufficient Logging & Monitoring
1. Secure Logging Implementation
2. Logging Using Syslog Format
3. Using ELK To Capture the Log Data
Hands-On Exercises:
1. Using HashiCorp Vault To Create and Consume Secrets Safely
2. Monitoring Docker Containers Using Grafana

Chapter 9: API Security, the DevSecOps Way

OWASP ASVS Framework
1. Understanding OWASP ASVS
2. Using ASVS To Secure Applications and APIs
3. Creating Checklists With OWASP ASVS
Automated Vulnerability Discovery
Finding Insecure Dependencies Using Software Component Analysis
Finding Vulnerabilities in Code Using Static Application Security Testing
Automating API Attacks Using Dynamic Application Security Testing
Addressing API Security Issues at Scale
Hands-on Exercises:
1. Creating a Simple CI/CD Pipeline
2. Deploying a Microservice(s) Using Continuous Deployment
3. Embedding Software Composition Analysis Into CI/CD Pipeline
4. Embedding Static Application Security Testing Into CI/CD Pipeline
5. Embedding Dynamic Application Security Testing Into CI/CD Pipeline

API Security Certification Process

After completing the course, you can schedule the CASP exam on your preferred date.
The process of achieving Practical DevSecOps CASP Certification can be found on the exam and certification page.