APIs are the backbone of modern applications—and a favorite target for attackers. Unlike traditional web apps, APIs often expose more functionality and data, making them high-value targets.

This guide covers practical techniques for testing API security, based on the OWASP API Security Top 10. …

This is my first write-up here. I will talk about how I bypassed captcha on two companies.

First One (Captcha Token Reuse)

While testing a site.example.com, I found that signing up on their site had a captcha. I solved the captcha challenge and captured the request with credentials, and I saw the …