Tutorvo
Menu
Courses Guides Pricing Log in Sign up
Cybersecurity Intermediate

API Security

The OWASP API Top 10 hands-on: BOLA, broken JWT auth, mass assignment — on a vulnerable API you run yourself.

7 lessons 42 min Certificate

  • One-time payment
  • 14-day money-back guarantee
  • Secure checkout with Stripe

About this course

Every mobile app and single-page site talks to an API, and most serious API bugs come down to the server trusting the caller too much. In this course you host a deliberately vulnerable API yourself and learn to read and probe it with curl and jq. You walk object ids to demonstrate missing object-level authorization, inspect a JSON Web Token and forge one the server wrongly accepts, and smuggle a privileged field into a signup to escalate your account. You also learn where function-level authorization, over-returned data, absent rate limiting and request forgery hide. Throughout, the focus is understanding why each flaw exists and how to close it with allow-lists, pinned algorithms and per-object checks. A final assessment ties the three main techniques together into a short report.

Curriculum

Course content

7 lessons · 42 min · final exam

  1. APIs — the New Attack SurfaceReading6 min
    Unlocked when you buy the course
  2. API Recon & curl/jqReading6 min
    Unlocked when you buy the course
  3. BOLA — Broken Object Level AuthorizationReading6 min
    Unlocked when you buy the course
  4. Broken Auth — JWT alg:noneReading6 min
    Unlocked when you buy the course
  5. Mass Assignment — Privilege via a FieldReading6 min
    Unlocked when you buy the course
  6. The Rest of the API Top 10Reading6 min
    Unlocked when you buy the course
  7. Final Exam — Assess Your Vulnerable APIReading6 min
    Unlocked when you buy the course
  8. Final exam8 questions, 70% to pass, unlimited retries.

Certificate

Finish with a certificate you can verify

Complete every lesson and pass the final exam to receive a certificate of completion for this course, with a unique credential ID and a public verification page.

  • Names the course, your score and the date of issue
  • A verification link for your CV or LinkedIn profile
  • 8 questions, 70% to pass, unlimited retries.

A Tutorvo certificate confirms that you completed a course. It is not an official or professional qualification.

Illustration. Your certificate shows your own name, course and credential ID.

Before you buy

Questions about this course

Is this a subscription?

No. You pay $9.99 once for this course. There is no subscription and nothing renews automatically. Prices are in US dollars; taxes may be added where required.

What exactly do I get?

All lessons and labs of this course, the final exam and the certificate, including later updates to the course, for as long as Tutorvo offers it. Access is personal and tied to your account.

Can I get a refund?

Yes. If you are not satisfied, email hello@tutorvo.com within 14 days of buying and we refund the course in full via Stripe. The guarantee does not apply once a certificate for the course has been issued to you, or where there are signs of abuse.

When can I start?

Right after payment. Access starts immediately at your request; for consumers in the EU/EEA the statutory right of withdrawal therefore ends once access has begun, while our 14-day money-back guarantee applies regardless.

Do I need Excel or other software?

No. The labs run in a spreadsheet inside your browser on a laptop, tablet or phone. Function names and syntax follow Excel.

Is the certificate an official qualification?

No. It confirms that you completed all lessons of the course and passed its final exam. It is not an official, state-recognised or professional qualification. The name is taken from your profile when the certificate is issued.

Full details are in our Terms · hello@tutorvo.com

Browse all Cybersecurity courses →
$9.99one-time payment
Buy course