API Testing

Cross-platform resources for API Testing: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

API Testing

This page aggregates cross-platform resources to practice API Testing: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/api-testing

PortSwigger labs practicing API Testing (5)

Lab	Difficulty	Topic	Official
Exploiting an API endpoint using documentation	APPRENTICE	API Testing	Open
Exploiting server-side parameter pollution in a REST URL	APPRENTICE	API Testing	Open
Exploiting a mass assignment vulnerability	PRACTITIONER	API Testing	Open
Exploiting server-side parameter pollution in a query string	PRACTITIONER	API Testing	Open
Finding and exploiting an unused API endpoint	PRACTITIONER	API Testing	Open

---

← Back to the full glossary

Last updated: 2026-05-08