How to Pass the ASCP Exam (Step-By-Step Guide)

Introduction

The API Security Certified Professional (ASCP) exam is intense. It is not a multiple-choice exam but requires a practical and in-depth understanding of APIs. This blog will discuss my experience, the exam format, and how to prepare for it.

My Experience

APISec hosted a mini-CTF called One Request to Rule Them All. You can find a writeup and videos of the challenges here. Since I came in the top 10, I received an ASCP voucher. Excited about this certification, I began my journey by reviewing some course material.

I started April 6th at approximately 10:30 AM. Within the first 2 hours, I retrieved one flag. However, after this, I was stuck. Surprisingly, I began going down weird rabbit holes that didn’t make much sense. Looking back, I was still trying to figure out what was happening and the application’s business logic. After taking a break, I realized what I was doing wrong and retrieved four flags within 30 minutes. This huge breakthrough gave me the confidence I needed to pass the certification. However, I was stuck and didn’t know what to do (again).

I always tell myself if you’re stuck, the answer may be in front of you. Looking at a few endpoints, I realized what I was missing and managed to secure the 6th flag. When you retrieve six flags, you have officially passed the certification. With excitement, I’m only 4 hours into the exam and have plenty of time to retrieve all eight flags. Unfortunately, I semi-forgot about the exam and came back to it with 45 minutes left. I identified a pathway to obtain the seventh and 8th flags, but didn’t have enough time to retrieve them.

Understanding the Exam Format

The exam is meant to feel like a real-world scenario. The tester is dropped into two applications that are both API driven. This exam starts when you want. This means you don’t need to schedule a specific date and time to begin. You can start at any point, but once you start, you have 12 hours to complete the exam.

With each exam voucher at the time of this blog, you will receive a free retake. If you fail, your first go-around. You must retrieve 6/8 flags scattered between the two API-driven applications to pass the exam.

If you want to learn more about the exam, you can read the Rules of Engagement.

Preparation Strategy

APISec University is the best resource for studying for this exam. After all, APIsec University founded the certification.

If you want some practical exams, you can do the One Request To Rule Them All CTF and the APISECCON 2024 CTF challenges, which can be found here.

If you’re unfamiliar with Burp Suite, I strongly encourage you to learn it. If you don’t, this exam will be nearly impossible to complete. MRE Security has published two blogs about Burp Suite to help you get started.

1. How to Install and Configure Burp Suite
2. How to Use Burp Suite For Web Application Security

Piece of Advice

When taking the exam, here are a few points you should do to pass:

• Take thorough notes—I made a mistake by not taking proper notes before the exam. Without notes to guide me through the process, it was a struggle to remember specific attack vectors. After each module, write down essential commands and strategies that are taught.
• Stay calm—I know this may sound a bit weird, but it’s true. When taking any exam, stay calm and focus on what’s in front of you. If you get stuck, take a step back, look at the information provided, and try again.
• Don’t think like an attacker—This one may also be strange since you’ll be hacking into an API, but trust me, don’t fall for what I did. When taking the exam, think of it as a regular user. Look through each endpoint and determine how a regular user would use the application. Once you understand the business logic, proceed with your methodology. This was a game-changer when I took the exam.

Conclusion

The ASCP makes you think outside the box. I believe you can do anything you set your mind to. If you’re starting in API security, this exam will be difficult but doable. I recommend checking out the course material, doing the previous APISec CTFs, and watching the walkthroughs on our YouTube channel, as they will help you understand how to perform an API assessment.