API Testing

Cross-platform resources for API Testing: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice API Testing: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 5 challenges across 1 platform — 5 PortSwigger. 0 with a Spanish writeup, 0 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Exploiting an API endpoint using documentation (Apprentice) · 🇬🇧
2. PortSwigger — Exploiting server-side parameter pollution in a REST URL (Apprentice) · 🇬🇧
3. PortSwigger — Exploiting a mass assignment vulnerability (Practitioner) · 🇬🇧
4. PortSwigger — Exploiting server-side parameter pollution in a query string (Practitioner) · 🇬🇧
5. PortSwigger — Finding and exploiting an unused API endpoint (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/api-testing

PortSwigger labs practicing API Testing (5)

Lab	Difficulty	Topic	Official
Exploiting an API endpoint using documentation	APPRENTICE	API Testing	Open
Exploiting server-side parameter pollution in a REST URL	APPRENTICE	API Testing	Open
Exploiting a mass assignment vulnerability	PRACTITIONER	API Testing	Open
Exploiting server-side parameter pollution in a query string	PRACTITIONER	API Testing	Open
Finding and exploiting an unused API endpoint	PRACTITIONER	API Testing	Open

---

← Back to the full glossary

Last updated: 2026-08-13