API Security
Training
Break real API endpoints the way an attacker does, then ship the authorization check that stops them.
10 hands-on exercises across the OWASP API Security Top 10. Free to play, no sign-up required.
Covers the languages your team ships in
The vulnerable code and its fix are shown in the language your developers work in every day.
- JavaScript
- TypeScript
- Java
- C#
- Python
- Scala
- PHP
- Ruby
- Go
- Kotlin
OWASP Top 10 for API Security
Broken Function Level Authorization
Call staff-only endpoints from a read-only account.
- OWASP APIAPI5:2023
- CWE-285
- CIS 16
- NIST CSFPR.PS
Broken Object Level Authorization
Swap an id and read another rider.
- OWASP APIAPI1:2023
- CWE-639
- CIS 16
- NIST CSFPR.PS
Broken User Authentication
Brute-force a six-digit login code.
- OWASP APIAPI2:2023
- CWE-287
- CIS 16
- NIST CSFPR.PS
Excessive Data Exposure
Read the fields the UI never shows.
- OWASP APIAPI3:2019
- CWE-213
- CIS 16
- NIST CSFPR.PS
Improper Inventory Management
Read records through a retired API version.
- OWASP APIAPI9:2023
- CWE-1059
- CIS 16
- NIST CSFPR.PS
Injection
Turn a search box into a full database read.
- OWASP APIAPI8:2019
- CWE-74
- CIS 16
- NIST CSFPR.PS
Insufficient Logging & Monitoring
Look up a customer and leave no trace.
- OWASP APIAPI10:2019
- CWE-778
- CIS 8
- NIST CSFPR.PS
Mass Assignment
Mint a loyalty balance with two extra keys.
- OWASP APIAPI6:2019
- CWE-915
- CIS 16
- NIST CSFPR.PS
Security Misconfiguration
Read a signed-in account from any website.
- OWASP APIAPI8:2023
- CWE-942
- CIS 16
- NIST CSFPR.PS
Unrestricted Resource Consumption
Scrape a catalog with one oversized request.
- OWASP APIAPI4:2023
- CWE-770
- CIS 16
- NIST CSFPR.PS
The Developer Track
Application security split by attack surface. Free, hands-on, no sign-up.
-
Application Security
22 exercisesSQL Injection · Stored XSS · Server-Side Request Forgery
-
Git & Repository Security
8 exercisesSecrets in Git History · Exposed .git Directory · Malicious Pull Requests
-
Cloud Security
17 exercisesPublic Storage Buckets · Over-Permissive IAM · Secrets in Image Layers
Frequently asked questions
What is API security training?
API security training teaches developers and engineers to find the authorization and data-exposure flaws specific to APIs, where there is no user interface to hide behind and every endpoint is directly reachable.
These exercises follow the OWASP API Security Top 10, the list maintained specifically for API risks rather than general web application risks.
How is API security different from web application security?
APIs fail differently. The most common API bugs are authorization flaws such as Broken Object Level Authorization, where the server checks that you are logged in but never that the record belongs to you.
APIs also leak through over-serialization: the interface shows a name and city while the JSON response carries phone numbers, birth dates, and coordinates. Those failures have no equivalent in a rendered page.
What does BOLA mean?
BOLA stands for Broken Object Level Authorization, the number one risk on the OWASP API Security Top 10. It happens when an endpoint accepts an object id from the request and returns that object without verifying the caller owns it.
In practice, changing one digit in a request returns another customer’s record, and sequential ids let an attacker harvest the entire dataset.
Are these API security exercises free?
Yes. Every exercise runs in your browser with no sign-up required.
Enterprise features such as completion analytics, SCORM and LTI packaging for your LMS, SSO, and custom content are available on paid plans.
See RansomLeak in Action
Try the free exercises or book a demo to see analytics, SCORM export, SSO, and custom content in your environment.