CAPIJ from TheXSSRat (thexssrat.podia.com). Course material → cert of completion → paid exam separate.
| # |
Chapter |
Status |
| 00 |
Introduction to CAPIE |
|
| 1 |
What is an API |
|
| 2 |
How to talk to an API |
REST vs SOAP ✓ |
| 3 |
OWASP API Top 10 2019 — article explanations |
← current |
| 3b |
OWASP API Top 10 2019 — demonstrations |
|
| 4 |
OWASP API Top 10 2023 — practical demos |
|
| 5 |
Pentesting documentation |
|
| 6 |
API security and firewalls |
firewall bypass ✓ (slides) |
| 7 |
Build your own APIs (exercise programming) |
|
| 8 |
Practice exam machines |
|
| 99 |
EXTRA |
|
| # |
Category |
One-liner |
| API1 |
Broken Object Level Authorization |
Change the object ID, get someone else’s record |
| API2 |
Broken User Authentication |
Weak login, bad tokens, no rate limit on auth |
| API3 |
Excessive Data Exposure |
API returns too much, client filters — attacker reads raw response |
| API4 |
Lack of Resources & Rate Limiting |
No throttling → brute force, DoS, cost blowout |
| API5 |
Broken Function Level Authorization |
Reach admin/user-managing functions as a normal user |
| API6 |
Mass Assignment |
Bind client-supplied JSON straight to the model → set isAdmin: true |
| API7 |
Security Misconfiguration |
Default creds, open CORS, verbose errors, unpatched |
| API8 |
Injection |
SQL/NoSQL/command/LDAP via unfiltered API input |
| API9 |
Improper Assets Management |
Old API versions, staging/debug hosts still live |
| API10 |
Insufficient Logging & Monitoring |
Attacks invisible; no detection or alerting |
| 2019 |
2023 |
Change |
| API3 Excessive Data Exposure |
merged into API3 Broken Object Property Level Authorization |
2019 split “returning too much” from “writable fields”; 2023 fuses read+write into property-level authz |
| API6 Mass Assignment |
merged into API3 |
Mass assignment is one form of property-level write abuse |
| API4 Lack of Resources & Rate Limiting |
→ API4 Unrestricted Resource Consumption |
Broadened from rate limits to all resource cost: payload size, CPU, third-party spend |
| API8 Injection |
removed |
Injection is a generic web risk (OWASP Top 10 proper), not API-specific |
| API10 Insufficient Logging & Monitoring |
removed |
Generic observability concern, not API-specific |
| — |
API6 Unrestricted Access to Sensitive Business Flows |
NEW — business logic abuse (buying out stock, coupon farming, scalping) |
| — |
API7 SSRF |
NEW — API fetches a user-supplied URL, reaches internal metadata/services |
| — |
API10 Unsafe Consumption of APIs |
NEW — trusting third-party API responses blindly |
Key reading of the diff: 2023 collapsed the “authorization” family and deleted the generic web risks. BOLA, Broken Auth, and BFLA are the constants across both versions — they survive because they are architectural, not implementation bugs. If you learn only three, learn those three.
| # |
Category |
One-liner |
| API1 |
Broken Object Level Authorization (BOLA) |
Access someone else’s object by changing an ID (id=123 → id=124) |
| API2 |
Broken Authentication |
Weak login, guessable tokens, no rate limiting on auth |
| API3 |
Broken Object Property Level Authorization |
Read/write fields you shouldn’t (mass assignment, extra props) |
| API4 |
Unrestricted Resource Consumption |
No limits → DoS via cost/lack of rate limits, payload size |
| API5 |
Broken Function Level Authorization |
Call admin functions as normal user |
| API6 |
Unrestricted Access to Sensitive Business Flows |
Abuse business logic (buying all stock, coupon spam) |
| API7 |
Server-Side Request Forgery (SSRF) |
API fetches user-supplied URL → reach internal networks |
| API8 |
Security Misconfiguration |
Default creds, CORS misconfig, verbose errors, missing headers |
| API9 |
Improper Inventory Management |
Old/undocumented endpoints still live, env variants |
| API10 |
Unsafe Consumption of APIs |
Blindly trusting third-party API data → injection |
- 2026-09-09 — section created. REST vs SOAP page.
- 2026-09-11 — authN vs authZ page. CAPIE 223-slide deck extracted; firewall bypass + lab workflow pages.
- 2026-09-12 — OWASP 2019 list + 2019→2023 diff added (chapter 3 start).