This session, focused 70% on practical, hands-on demos and 30% on theory, will teach attendees how to identify and exploit common API vulnerabilities. The presentation covers key tools such as BurpSuite, Postman, and Kiterunner, and explores techniques for testing security features like rate limiting, JWT manipulation, and object-level authorization. Demos include live security testing with tools like mitmproxy for brute-force attacks and Hashcat for cracking JWT tokens. Attendees will leave with actionable skills to secure their own APIs and prevent real-world attacks.