Closing Keynote Day 1 API First Hacking
summary
Claim: APIs are the easiest path to data breaches, with attackers using endpoints rather than pivoting through networks. Cited breaches: T‑Mobile ~37M accounts, Bumble ~95M, Optus ~10M. Survey shows ~71% confidence in API tooling but 76% suffered incidents; automated scanners (Burp Suite, OWASP ZAP, Nessus, Tenable) produce false negatives. Practical tests include creating resources as user A then accessing as user B to find broken object level authorization, JWT algorithm switching, fuzzing inputs, file‑upload handling, version‑endpoint checks, and Postman + Appisec + manual Burp Pro workflows.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:06Keynote overview
- 2:12APIs as attack vector
- 5:12API breach examples
- 8:43False confidence in API security
- 10:12Automated API security limits
- 13:52API testing gaps
- 16:42API auth and authorization
- 21:34Improper asset management in APIs
- 24:03Fuzzing and input validation
- 26:12API-first security testing
- 28:43API security remediation
- 29:50Free API pen testing course
- 30:12Q&A
related talks
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
26mOffensive API Penetration Testing
39mThe API Assessment Primer
30mAPI Security - Divide & Conquer
31mAPI security
29mDecoding a Decade of API Breaches: Key Learnings Unveiled
19mAvoid These API Security Pitfalls: Expert Insights
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge