PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

API Pentesting and Best Practices

hackerone.com | blog | #api-security | #penetration-testing | #ptaas | #ptes | #owasp-api-top-10 | #object-level-authorization
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

APIs have become prime attack targets. HackerOne's community-driven PTaaS applies PTES, OWASP API Top 10, and CIS Controls to find API-specific flaws like broken object-level authorization.
Published
Collected

Related coverage

blog · hackerone.com
External Network Penetration Testing and Best Practices
Learn how external network penetration testing hardens internet-facing assets. Get best practices, common risks, and how HackerOne PTaaS reduces risk fast.
blog · hackerone.com
Azure Cloud Configuration Review
HackerOne outlines Azure configuration review methodology based on PTES, CIS Azure Benchmarks, and Well-Architected Framework, covering Entra ID misconfigurations and shared responsibility pitfalls.
blog · hackerone.com
What Is the Difference Between Pentesting and Bug Bounty?
Pentesting and bug bounties complement each other: this guide compares consultancies, traditional PTaaS, community-driven PTaaS, and automated pentesting on effectiveness, efficiency, and value.
blog · hackerone.com
Use Hackerone’s Enhanced Pentest as a Service to Streamline Security Testing
HackerOne enhances its pentest as a service: ten-day average launch, real-time findings, 26 SDLC tool integrations, 60 days of free retesting, and about 20% of findings rated high or critical.
blog · bishopfox.com
Unified Code, Unified Risks: Uncovering Vulnerabilities in .NET MAUI Applications
Bishop Fox shows how to bypass .NET MAUI's platform packaging to extract readable C# assemblies from Android and iOS apps, then use that shared-assembly insight to uncover critical vulnerability patterns in common business logic.
blog · projectblack.io
Bypassing EDR with Local AI
A pentest shows Claude refuses to build an LSASS dumper, but local DeepSeek and uncensored Qwen models produce a working XOR-encrypted minidumper, making AI-assisted EDR evasion nearly effortless.
Back