Apisecure, 14 & 15 March 2023 - Vaishali Nagori, Security Researcher at Appknox.
summary
Covers concrete business‑logic exploits and fixes: examples include unlimited Pro access by editing duration (changed 30→365 in the request), an API that returns exam questions before the test, customer‑support chat that accepts any order ID to change/cancel orders, coupon/return math that preserves discounts after returns, and AWS URLs lacking presigned signatures that leak paid audio. Testing uses Burp Suite and Postman, audits over 200 apps, finds ~80% of issues trace to missing server‑side input validation and insufficient backend ownership checks.
AI-written summary · about
chapters (14)
- 0:00Welcome
- 1:08Introducing Vaishali Nagori
- 2:11Business logic flow
- 3:15Unlimited pro account access
- 6:04Revealing exam questions early
- 7:54Abusing customer support chat
- 10:47Discount abuse via returns
- 14:03Accessing paid recordings without payment
- 15:52Bypassing COD minimum order limit
- 18:21Summary and book launch
- 19:25Q&A Common API vulnerabilities
- 21:14Q&A Mobile vs web API testing
- 24:01Q&A Vaishali’s tool stack and Burp Suite
- 28:59Q&A Contact and social media
related talks
55mBreaking and Fixing Web Application Security
57mEnterprise Ethical Hacking Cloud Applications
46mAPI Security – Divide & Conquer
27mCommon Application Security Mistakes that Enable Automated Attacks
41mI’m an API Hacker and Here’s How I Hack Everything from the Military to AI
15mJumpstart Security & Penetration Testing APIs
50mAppSec is Too Hard!?
46mLive hacking: Breaking into your Java web app