How Do They Get In?! Understanding the API Attack Vector
summary
Explains how attackers find and abuse APIs using concrete tools and techniques: Burp Suite, OWASP ZAP, Charles Proxy and Fiddler to proxy and decrypt mobile and web traffic by installing a forged root CA; reverse engineers public app binaries to extract endpoints; exploits broken object-level authorization to fetch unauthorized records and automates large-scale credential stuffing attacks, distributed and throttled to evade rate limits and WAFs; cites Salt Security research and a C3A-style telemetry+ML defense that discovers and blocks such abuse.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:01Agenda
- 2:23How Did They Discover Apis
- 5:11Methodologies
- 6:32Reverse Engineering Techniques
- 11:04Intercepting that Encrypted Communications
- 16:01How Do Attackers Automate Their Api Attacks
- 16:47Credential Stuffing
- 17:58Rate Limiting
- 20:38What Does It Mean if an Api Is Leaking
- 22:58How Do You Know if You'Re Actually under Attack
- 24:27Threat Research Reports
related talks
35mHow to Break API's
30mAPI Security - Divide & Conquer
39mThe API Assessment Primer
30mAttack API Architecture
50mAPI Abuse through Mobile Apps: New Attacks, New Defenses
26mOffensive API Penetration Testing
53mHacking And Defending APIs: Red And Blue Make Purple
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly