The Certified API Security Testing Practitioner (CASTP) course is a hands-on cybersecurity program designed to teach learners how to identify, exploit, and remediate security vulnerabilities in modern APIs. The course covers API fundamentals, authent
11 modules • 59 total items
This module introduces the Certified API Security Testing Practitioner course and provides an overview of the OWASP API Security Top 10. Learners will understand the API security testing methodology, common API attack surfaces, key risks affecting modern APIs, and the major vulnerability categories covered throughout the course.
This module introduces Broken Object Level Authorization (BOLA), one of the most critical API security vulnerabilities. Learners will understand how attackers manipulate object identifiers to gain unauthorized access to other users’ data, how to identify BOLA issues during API testing, and how proper authorization controls can prevent these attacks.
This module covers Broken Authentication vulnerabilities in APIs, where weaknesses in login, token, session, or credential handling can allow attackers to impersonate users or gain unauthorized access. Learners will understand common authentication flaws, how to identify and test them, and how secure authentication mechanisms can reduce API security risks.
This module covers Broken Object Property Level Authorization (BOPLA), where APIs improperly expose or allow modification of object properties that users should not be able to access. Learners will understand how attackers exploit excessive data exposure and mass assignment issues, how to identify these flaws during API testing, and how proper property-level authorization can prevent unauthorized data access or modification.
This module covers Unrestricted Resource Consumption, where APIs fail to properly limit requests or resource usage such as CPU, memory, bandwidth, or database operations. Learners will understand how attackers can abuse these weaknesses to cause performance issues, service disruption, or increased operational costs, and how rate limiting, quotas, and resource controls can help secure APIs.
This module covers Broken Function Level Authorization (BFLA), where APIs fail to properly restrict access to sensitive functions based on user roles or permissions. Learners will understand how attackers can access administrative or privileged API functions, how to identify authorization flaws, and how strong role-based access controls can prevent unauthorized actions.
This module covers Unrestricted Access to Sensitive Business Flows, where APIs fail to properly protect critical business operations from automated or abusive use. Learners will understand how attackers can exploit workflows such as purchases, bookings, registrations, or account actions, and how rate limits, validation, anti-automation controls, and business logic protections can reduce these risks.
This module covers Server-Side Request Forgery (SSRF), where an API can be manipulated into making unauthorized requests to internal or external systems. Learners will understand how SSRF vulnerabilities occur, how they can expose internal services or sensitive data, and how input validation, allowlisting, network restrictions, and secure request handling can help prevent these attacks.
This module covers Security Misconfiguration, where insecure default settings, unnecessary services, exposed debug information, improper headers, or weak security controls can leave APIs vulnerable to attack. Learners will understand how to identify common configuration weaknesses and apply secure configuration, hardening, and deployment practices to reduce API security risks.
This module covers Improper Inventory Management, where organizations fail to properly track, document, update, or retire API endpoints and versions. Learners will understand how outdated, undocumented, or exposed APIs can increase the attack surface and how proper API inventory, version management, documentation, and lifecycle controls can reduce security risks.
This module covers Unsafe Consumption of APIs, where applications place excessive trust in data received from third-party or external APIs without proper validation and security checks. Learners will understand how insecure API integrations can introduce vulnerabilities and how input validation, secure communication, authentication, and proper error handling can reduce these risks.
Learn at your own pace, forever
Access on any device
Recognized upon finishing
Assignments & quizzes included
Join 0+ students already learning Certified API Security Testing Practitioner