Publication:Juan M. R.

1. Introduction REST APIs are the nervous system of modern applications: they connect frontends to backends, microservices to each other, and enable mobile devices to access data in real time. But if a poorly protected database can be compromised with SQL injection, a poorly designed API can expose the entire infrastructure with a single payload. In this article we will perform a complete security lab on a REST API using Burp Suite, the de facto standard tool for web pentesting. We will cover everything from endpoint discovery to exploiting common vulnerabilities: IDOR, missing rate limiting, parameter injection, and authentication errors. …