Hacking And Defending APIs: Red And Blue Make Purple
summary
A practical run‑through of an API pentest that names tools and tradeoffs: passive recon, active discovery with local proxies and bruteforcers like Kite Runner and gobuster, and common findings such as broken object level authorization, mass assignment, excessive data exposure, injection and pagination‑driven resource exhaustion. Claims that WAFs lack compute for deep token/context checks and that runtime monitoring plus targeted testing (OpenAPI/Postman artifacts, JWT tooling and fuzzing) catch most post‑deployment attacks are argued and illustrated.
AI-written summary · about
chapters (17)
- 0:00Start
- 7:59Passive Recon
- 9:33Active Recon
- 12:23Discovery
- 15:32Broken Object Level Authorization (BOLA)
- 19:17Broken User Authentication
- 21:37Excessive Data Exposure
- 25:09Lack of Resource & Rate Limiting
- 28:42Broken Function Level Authorization
- 31:37Mass Assignment
- 34:33Security Misconfiguration
- 35:20Injection
- 37:53Improper Assets Management
- 38:45Insufficient Logging & Monitoring
- 39:51Fuzzing
- 40:49Structural vs Data Attacks
- 42:15Special Notes on GraphQL
related talks
26mOffensive API Penetration Testing
15mJumpstart Security & Penetration Testing APIs
34mPurple Team Strategies for Application Security
35mHow to Break API's
35mClosing Keynote Day 1 API First Hacking
25mHow Do They Get In?! Understanding the API Attack Vector
25mHack-Proof Your API: Exclusive Attack Simulator Deep Dive 🛡️
39mThe API Assessment Primer