Landmines in the API Landscape
summary
Claim: APIs become the top attack vector (Gartner) because surface, controls and tooling lag. Walks through the OWASP API Top 10 with concrete attack patterns: BOLA by swapping user IDs, mass exposure found across 435 endpoints, second‑order XSS flowing through seven systems, an XML payload with 32 extra spaces causing a crash. Recon/tooling notes: passive discovery, Burp/ZAP, Kite Runner, JWTtool, nmap, Nessus, Swagger/Introspection, plus posture/runtime/testing mapping and a curated public page of API security tools.
AI-written summary · about
chapters (11)
- 0:00Start
- 10:35A better (security) definition of an API
- 13:00Passive Recon
- 15:26Active Recon
- 23:22Broken Object Level Authorization (BOLA)
- 27:56Broken User Authentication
- 34:32Lack of Resource & Rate Limiting Failure to provide limits is a recipe for DOS or worse
- 37:34Broken Function Level Authorization
- 44:24Security Misconfiguration
- 50:15Insufficient Logging & Monitoring
- 52:39Key Takeaways for API testers
