Harmonizing the OWASP API and Application Top 10 Lists
summary
Combine OWASP API Top Ten (2019) with OWASP App Top Ten (2017/2021) to cover gaps: shows which categories overlap (injection, auth, misconfiguration) and which are API‑specific (excessive data exposure, rate limiting, mass assignment, improper asset management, SSRF). Describes concrete detections and defenses: Swagger/OpenAPI and reverse‑engineered mobile calls, interception proxies (ZAP), prepared statements, WAF tuning, certificate pinning, credential vaults, dependency‑check SCA, and cites the Capital One SSRF exploit as a worked example.
AI-written summary · about
chapters (13)
- 0:00Intro
- 0:50Five Questions
- 5:25Agenda
- 6:47Web Services
- 8:31APIs
- 10:45GraphQL
- 14:19Top 10 List
- 17:56Injection Attacks
- 24:41API Weaknesses
- 34:29Defenses
- 38:39Insecurity
- 42:58Excessive Debt
- 50:01Final Thoughts
