Mobile backend API security
You audit the API the app talks to in your own lab: you derive the endpoints from the APK, find mistakes in authentication, authorisation, sessions, rate limiting and versioning, and fix them on the server side.
Level 301 · 22 lessons · 18 practice labs
Lessons
Deriving the endpoints
- Deriving endpoints from the APK: Retrofit interfaces and URL constants
- API inventory: comparing the OpenAPI document with reality
- The client is not trusted: checks belong on the server
- Reproducing recorded requests with curl
- Short task: derive the endpoint list from an APK and flag the undocumented ones
Authentication and sessions
- Token authentication on mobile: access and refresh tokens
- OAuth for apps: PKCE and the system browser
- JWT validation mistakes: signature, expiry, audience
- Logout, token revocation and the device list
- One-time codes and device binding
- Short task: make the server revoke a refresh token that still works after logout
Authorisation and business logic
- Object-level authorisation: reading someone else's record
- Function-level authorisation: hidden admin endpoints
- Mass assignment and returning too much data
- Moving price and limit checks from the client to the server
- Short task: find the endpoint that returns someone else's order and add an ownership check
Resilience and operations
- Rate limiting and lockout: login and code verification endpoints
- API versions and old clients: the forgotten v1
- Why API keys are not secrets, and app attestation
- API logs: noticing abuse
- Short task: add a rate limit to the code verification endpoint and confirm it in the logs
Capstone
- Capstone: audit, fix and retest the API of a courier app
Practice labs
- Find the base API address from the APK: Find the client's base URL and version path in jadx output.
- Derive the endpoint list from the Retrofit interface: Tabulate method, path and parameters.
- Find undocumented endpoints by comparing with OpenAPI: Compare the list from the APK with the document and confirm the undocumented ones with curl against the lab API.
- Read the fields of a JWT: Decode the token in a recorded request and state its expiry and audience fields.
- Close a refresh token that works after logout: Show on the lab API that the token is still accepted after logout and add revocation on the server side.
- Fix an endpoint that does not verify the signature: Prove on your own lab API that a token with a broken signature is accepted, fix the validation code and retest.
- Reproduce the request that returns another user's record: Call the order endpoint with two lab accounts and show the missing ownership check.
- Add an ownership check to the order endpoint: Fix the server code and confirm that another account's record now returns 403.
- Sweep and fix every object endpoint for authorisation: List the endpoints that take an ID parameter, test them with a two-account script and close those left open.
- Find the fields returned beyond need: Mark the sensitive fields in the profile response that the client does not use.
- Protect a hidden admin endpoint with a role check: Show that an admin path visible in the APK works with an ordinary account and add a role check.
- Close mass assignment and a client-side price check: Prove the update request accepts role and price fields, then add an allowed-field list and price calculation on the server.
- Measure whether the login endpoint has a rate limit: Send twenty requests in a row to your own lab API and record the response codes.
- Add a rate limit to the code verification endpoint: Add a per-account attempt limit and delay and confirm it in the logs.
- Find the forgotten v1 API and retire it: Find the unprotected version used by the old client, measure its use from the logs and disable it with a shutdown plan.
- Count failed logins in the API log: Extract the number of failed logins per account from the log.
- Detect sequential ID enumeration in the logs: Find the session where one token requests many record numbers in a row and write an alert rule.
- Audit, fix and retest the API of a courier app: Extract authorisation, session and rate limit findings on the Kuzeyyıldızı Kargo lab API, fix three and prepare a retest table.
About this course
You audit the API the app talks to in your own lab: you derive the endpoints from the APK, find mistakes in authentication, authorisation, sessions, rate limiting and versioning, and fix them on the server side.
What you will learn
- Deriving the endpoints
- Authentication and sessions
- Authorisation and business logic
- Resilience and operations
- Capstone
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.