🧪 API Penetration Testing Lab Setup for APIsec University

An all-in-one automation project to help students of APIsec University's API Penetration Testing Course quickly set up a ready-to-use lab environment on Kali Linux. Whether you're just starting or want to save hours of manual work, this project sets up tools, users, and configurations for efficient API hacking.

---

🎯 Project Goals

• ⏱️ Save setup time for students and professionals
• ⚙️ Automate installation of key API testing tools
• 🔐 Create a safe, isolated hacking user (hapihacker)
• 📁 Organize wordlists, configs, and tools in a single environment

---

🧩 What's Included?

Script/File	Purpose
master_setup.sh	🎯 Main script to orchestrate the entire setup
setup_api_lab.sh	👤 Creates a new user (hapihacker) with ZSH and sudo access
install_burpsuite.sh	🛡 Installs Burp Suite Community Edition
install_postman.sh	📬 Installs Postman (API testing tool)
install_sublime.sh	📝 Installs Sublime Text Editor
install_arjun.sh	🔍 Installs Arjun (API parameter discovery tool)
install_kiterunner.sh	🚴 Installs Kiterunner (API endpoint brute-forcer by Assetnote)
install_jwt.sh	🔐 Installs JWT Tool for testing JSON Web Tokens
install_mitmproxy2swagger.sh	🔄 Installs mitmproxy2swagger to convert HTTP traffic into Swagger
install_wordlists.sh	📚 Installs essential API-related wordlists
cleanup.sh	🧹 Cleans up temporary files and old downloads
SecLists.zip	🔐 Contains SecLists for brute-forcing, fuzzing, etc.
wordlists/	📁 Custom wordlists for endpoint/path discovery

---

🧰 Requirements

• ✅ Kali Linux (tested on latest versions)
• ✅ Root or sudo privileges
• ✅ Stable internet connection

---

⚙️ Quick Start

⚠️ Important: Run this only on lab/test systems. The script modifies users, installs tools, and makes system changes.

1. Clone the Repository

git clone https://github.com/Abwonder/APIsec_pentest_labsetup.git
cd apisec-lab-setup

⚙️ Installation Instructions

2. Make All Scripts Executable

chmod +x *.sh

3. Run the Master Setup Script

./master_setup.sh

This will:

👤 Create a new user (hapihacker)

🧰 Install essential tools for API Pentesting

📚 Set up wordlists

⚙️ Prompt you for optional customizations

👨‍🎓 Use Case: APIsec University Students

This project is designed to match the toolset taught in the APIsec University course. It gives learners a ready-made playground with all tools pre-installed and organized.

You can now focus more on learning the hacking methodology rather than wasting time configuring the environment. 📸 Sample Output

[+] Creating lab user 'hapihacker'...
[+] Installing Burp Suite...
[+] Installing Postman...
[+] Installing Arjun...
[+] Installing Kiterunner...
[+] Installing JWT Tool...
[+] Installing mitmproxy2swagger...
[+] Installing Sublime Text...
[+] Installing wordlists...
[+] Setup Complete! Login as hapihacker and start testing.

🛠️ Customization

You can run individual scripts to install specific tools:

./install_postman.sh
./install_burpsuite.sh

Or reinstall any failed parts of the setup manually. 🤝 Contributions

Feel free to fork this repository, improve the scripts, or add new tools to make this even more powerful for API security learners. 📄 License

This project is open-source under the MIT License. 🙌 Credits

Developed by Abioye Oyatoye [HackTerminuX] YouTube Channel: LinkedIn:

Inspired by the learning journey at APIsec University