// Offense

Explore API Security

Authenticated is not the same as authorized. Most of the OWASP API Top 10 lives in that gap.

You can log in. That's not the question. The question is whether the server checks that /orders/124 belongs to you before it hands over the data — and a huge share of production APIs never make that check. Nugget starts here because it's where the real bugs are, not where the old web Top 10 trained you to look.

A session starts with Nugget sketching the request on the whiteboard: verb, path, headers, body — then asking you what the server actually verifies at each step, versus what it just assumes. From there you push on it: swap an object ID, add a field the response showed but the docs never mentioned, decode a JWT and read what's sitting in the payload. Nugget isn't handing you the finding. It's aiming the next question at whatever you skipped.

This isn't a replacement for your coursework or your bug bounty grind — it's the place where you build the reflex of asking 'can I do this to THAT object, as THIS user?' before you ever open Burp for real.

// What a session feels like

You bring the questions. Nugget asks the next one.

Nugget lays out a raw JSON response on the whiteboard — fields for display_name and email visible in the UI, plus a role and an internal_id that never render. It asks you which of those a client should be able to write back, and why the server can't just trust that the frontend won't send them.
In the terminal, you're pointed at two nearly identical requests: GET /orders/123 with your token, then GET /orders/124. Nugget doesn't tell you what happens — it asks you to predict the response before you run it, then asks what that result implies about how the server decided you were allowed to see it.
You paste a JWT into the session and Nugget walks you through decoding the payload by hand, then asks what you'd try first — algorithm confusion, a guessable HMAC secret, or checking whether `exp` exists at all — and why picking wrong wastes the one shot you get in a real test.

// Pairs well with

Social Engineering OSINT Web Exploitation

Start exploring API Security tonight — a 30-day trial, cancel anytime.

Start your 30-day trial