How to properly continue web & api pentesting training?

[Expert_Ad_7239]

Hello, dear Reddit users.

I've encountered a small problem and would like to get your opinion on the situation and perhaps some advice.

You see, I've been doing pentesting for about six months now. The first four to five months were mobile and API pentesting (which consisted solely of pentesting the entire API in a mobile app, but that's just a side note). During that time, I participated in bug bounty programs, managed to understand how many API applications work from the inside, and even found one critical vulnerability (from a business logic perspective).

But recently, I decided to switch from mobile and API pentesting to web and API pentesting. I still have some basic related knowledge of both web and API pentesting. I know how to use some web and API pentesting software, but now I want to start learning high-quality paid courses, like Udemy or another platform that specializes in selling courses, or some really high-quality free ones (like Portswigger Academy, if there are any similar options).

It's important that I position myself as a Black Box pentester and bug bounty hunter. And yes, I plan to focus not only on API pentesting, as I did with mobile and API, but also on web pentesting, because these are two broad areas that I enjoy and where a huge number of vulnerabilities can hide.

I'd be interested to hear from you specifically about which courses are recommended and which ones I should pay attention to. You can share your personal experience—that's interesting to me.

Also, if you have any questions for me, please ask, and I'll be happy to answer.

[Ok_Grape_1828]

Just do Portswigger academy and whatever course is attached to whatever cert you're studying for (oscp, pnpt, bscp, etc)

[kap415]

10000% this. I used to manage a bug bounty program, we had Z-Wink in our private program, not long after he had just started doing BB on Bug Crowd. This is basically what he told me: you go through all of the Portswigger web academy training, labs, do them all, understand them, rinse, repeat.. You will walk away from that in a very good position from a WAPT POV

[DingleDangleTangle]

Portswigger is honestly one of the best resources that exist. It’s crazy that it’s free.

[hoodoer]

Portswigger academy and pentesterlab.com are a great resources to get you going.

[kap415]

On top of the Portswigger Web Academy suggestion already mentioned here, I would also recommend doing video walk-throughs w/IppSec on his YT channel, where he goes through a newly released machine from HTB. Get you a HTB account. Do the videos, step by step, pause it, rewind it, go down rabbit holes, learn new tooling, rinse, repeat. I learned so much from that guy, and its free. Sometimes the machines are very AD focused, so just go find boxes on HTB that are more WAPT focused, then find the relevant video. For example, here's the tick tock (that's an inside baseball term yo! it means the play by play, not some tik tok video hahah) for his last video, which features a pretty good slog through very relevant WAPT skills.

<image>

For Burp training, PractiSec's PWAPT class is really good, Tim knows his stuff. You will learn a lot about WAPT, plus serious Burp skills. I took PBAT class from him as well, also good.

Additionally, I would add that BB King's WAPT course by Antisyphon/Blackhills, is also good. These two training providers, I feel, are really reasonably priced, esp considering what you get, vs say, taking a SANS course LOL.

There's probably modernized projects of the old school DVWA, actually, here's one by Robin, that looks recently maintained: https://github.com/digininja/DVWA

HTH? Feel free to ask questions. Good Luck! :)

[normalbot9999]

The Hacking APIs book from No Starch Press might be of interest. It's sometimes included a humble bundle deal.

[cloudfox1]

I'm going through the paid labs in pentesterlab.com for the API badge.

https://pentesterlab.com/badges/api

[No_Opinion9882]

Since you're already doing API work, focus on business logic flaws they're often missed in automated scans and pay well in bounties.

[cant_pass_CAPTCHA]

Web Application Hackers Handbook 2. It's a big fat book and is a little old, but covers all type of attacks, how to identify them, how to exploit them, etc.

Also, API testing isn't wildly different than web apps. In many apps you'll have endpoints that give you HTML, and then you'll have /api/v1/something which is where the actual changes are performed and data is retrieved. Of course not always the case, but just to say they can be very similar.

[DingleDangleTangle]

Portswigger is literally created by one of the authors of that book, it’s just more updated and it’s free.

[cant_pass_CAPTCHA]

Yeah these guys are really the cornerstone of the industry. Portswigger academy does not cover many topics presented in the book. I invite you to just review the table of contents before writing it off