// Comparison

Bug Bounty Bootcamp vs Hacking APIs: Which Should You Read?

Two cybersecurity books on Web Security, compared honestly: who each is for, what each does best, and which to read first.

Beginner

4/52021

Bug Bounty Bootcamp

The Guide to Finding and Reporting Web Vulnerabilities

Vickie Li

Vickie Li's pragmatic walk through the bug-bounty workflow, from picking a program and recon to reporting findings that actually pay out.

Intermediate

4/52022

Hacking APIs

Breaking Web Application Programming Interfaces

Corey J. Ball

Corey Ball's structured approach to attacking REST and GraphQL APIs: enumeration, auth flaws, business logic, mass assignment, and the testing harness around them.

Read this if

Readers who want a workflow-first introduction to bug bounty. Li covers recon, methodology, the bug classes that pay, automation, and reports, all in the order you'd actually do them.

Pentesters and bug bounty hunters who realized that most production attack surface is now API, not HTML. Ball's structured approach covers REST, GraphQL discovery, BOLA, mass assignment, JWT abuses, and the operational tooling around them.

Skip this if

Practitioners who already work in offensive security or who want depth on individual bug classes. The book is a wide first pass, not a deep specialization.

Readers who want generalist web security; the book is API-focused and assumes you already understand OWASP-class web bugs.

Key takeaways

The recon chapter (subdomains, GitHub leaks, archived endpoints) alone justifies the book; most beginners skip recon and miss most of the bounty.
The chapters on race conditions and business logic flaws cover bug classes that don't show up in older textbooks but pay regularly today.
Li's writing on reports, triage interaction, and disclosure ethics is the calmest and most professional section in the bug-bounty book market.

API attack surface is dramatically underexploited compared to HTML attack surface; for most public bug bounty programs, the API is where the bounties hide.
BOLA (broken object-level authorization) is the dominant API bug class and the one that pays best; Ball's framing is the cleanest in print.
Burp Suite Professional + Postman + a custom recon pipeline is the practical toolset; the book justifies the choice and shows you how to use them together.

How they compare

Bug Bounty Bootcamp and Hacking APIs are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Bug Bounty Bootcamp is pitched at beginner level. Hacking APIs is pitched at intermediate level. Read the easier one first if you're not yet comfortable with the topic.

Bug Bounty Bootcamp and Hacking APIs both cover Web Security, Offensive, so reading them in sequence reinforces the same material from different angles.

Keep reading