Automating web and API checks with Python
You automate sessions, tokens and API calls against your own lab app in Python and write repeatable security checks.
Level 201 · 15 lessons · 12 practice labs
Lessons
Knowing the client
- httpx and requests: sync and async clients
- Headers, redirects and timeouts
- Routing requests through a local proxy to watch them
- Short task: check a site’s security headers
Sessions and identity
- Logging in with a form and a CSRF token
- Bearer tokens and reading a JWT’s contents
- API keys and the OAuth client flow
- Testing whether a session really expires
- Short task: prove whether an old token still works after logout
API checks
- Listing every endpoint from an OpenAPI definition
- Testing a role-based access matrix automatically
- Measuring whether rate limiting works
- Short task: find the endpoint that exposes another user’s record
Wrap-up
- Turning checks into pytest tests
- Capstone: a security regression suite for the lab API
Practice labs
- Missing security headers: Write a script that checks HSTS, CSP, X-Content-Type-Options and cookie flags on the lab app’s pages, and list what is missing per page.
- Where does the redirect chain lead: Write an httpx script with timeouts that follows the lab app’s post-login redirects and finds steps that drop to HTTP or leave for an outside domain.
- Requests that never show in the proxy: Fix an async client that sends some requests directly despite a local proxy being set, and prove every request appears in the proxy log.
- A form login with a CSRF token: Write a requests script that takes the CSRF token from the lab app’s login page, logs in and shows it reached the profile page.
- What travels inside the JWT: Decode the header and claims of the JWT issued by the lab API, and produce a short report on expiry, role and unnecessary personal data.
- A token still valid after logout: Within the authorised test, write a script that checks whether an old token is still accepted by the lab API after logout, password change and expiry, and save evidence for each case.
- An endpoint list from OpenAPI: Write a script that lists every endpoint in the lab API’s OpenAPI definition with method and authentication requirement as a table.
- Does rate limiting really work: Send a controlled number of requests to the lab API’s login endpoint and measure at which request rate limiting starts and how long it takes to reset.
- Another user’s record is exposed: Write a script that tests the role table automatically with two test accounts, find the endpoint in your own lab API that returns another user’s record, and save the evidence.
- Move the checks into pytest: Turn previously written header and session checks into pytest tests, run them against the lab API with one command and show the result.
- Parameterised tests for the role matrix: Test the Pinecrest Bank lab API role-endpoint permission table with pytest parameters, and show the two endpoints that deviate as failing tests.
- Tests that pass one time and fail the next: Fix security tests that are flaky due to shared test data and order dependence so each test sets up and cleans its own account, and get the same result across five runs.
About this course
You automate sessions, tokens and API calls against your own lab app in Python and write repeatable security checks.
What you will learn
- Knowing the client
- Sessions and identity
- API checks
- Wrap-up
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.