How to Break API's
summary
Shows concrete attacks and tools: use Burp or Fiddler to create users copy session tokens and replay requests to prove BOLA (Broken Object Level Authorization), wrap IDs in arrays or move IDs between URL and body, and test v1/v2/v3 and XML content types to find hidden or legacy endpoints. Demonstrates excessive data exposure chains that escalate to an actual account takeover when a v3 endpoint leaks PII. Anchors methods to the OWASP API Top 10 and gives repeatable pentest steps.
AI-written summary · about
chapters (18)
- 0:00Start
- 0:15Agenda
- 3:03What Has Changed between Traditional Applications and Modern Applications
- 10:56How Can You Read Developers Minds To Understand What They Wrote on the Code
- 11:06Think like a Developer
- 13:54Common Api Vulnerability
- 14:31Extensive Data Exposure
- 14:44Broken Functional Virtualization
- 15:42Clients of Uber
- 18:01Is the Resource Private
- 20:41How Can You Validate that the Specific Endpoint Is Vulnerable
- 21:01Create User
- 25:37How To Exploit this Vulnerability in Apis
- 25:54Understand the Hierarchies between Users Roles and Resources
- 30:29Api Predictability
- 30:40How Can We Leverage the Predictable Nature of Rest Apis To Find Admin Endpoints
- 31:44How Can We Leverage the Predictable Nature of Rest Apis To Find Hidden Features
- 33:51How Can You Leverage the Predictable Nature of Rest Apis To Find Hidden Versions
related talks
30mAPI Security - Divide & Conquer
46mAPI Security – Divide & Conquer
25mHow Do They Get In?! Understanding the API Attack Vector
26mOffensive API Penetration Testing
25mOWASP Top 10 for APIs
39mThe API Assessment Primer
15mJumpstart Security & Penetration Testing APIs
53mHacking And Defending APIs: Red And Blue Make Purple