All your APIs are mine - Secure them now
summary
Shows concrete API failures in a Spring Boot sample: object-level authorization allows ID enumeration, an insecure JWT implementation accepts alg: none and is cracked via a leaked secret from a wordlist, and public docs feed Postman collections that speed reconnaissance. Demos use Shodan and OWASP tools to find endpoints, a JWT tool to manipulate tokens, and a brute force that recovers the symmetric key; recommends Spring Security, Spring Cloud Gateway rate limiting, and ACL or UUIDs to fix the issues.
AI-written summary · about
chapters (15)
- 0:00Introduction and agenda
- 1:25API security 101
- 2:35API technologies overview
- 4:54Discovering and analyzing APIs
- 7:02Tooling and attack surface
- 12:16Securing API documentation
- 13:10API security attacking points
- 17:19Broken object level authorization
- 22:52Broken authentication and JWT
- 30:51Object property level issues
- 32:34Resource consumption and rate limits
- 34:30Broken function level auth and SSRF
- 37:17Security configuration and automation
- 40:11Inventory and unsafe consumption
- 42:13Summary and resources
related talks
22mAPI Authentication Deep Dive: OAuth 2.0, Tokens, and JWTs
01h 29mAPI Vulnerabilities and What to Do About Them
45mOpening Keynote – Tushar Kulkarni
46mAPI Security – Divide & Conquer
15mJumpstart Security & Penetration Testing APIs
01h 25mThe State of Securing RESTful APIs with Spring
45mAPI Security: Acting Now to Enable Security Controls
49m10 Excellent Ways to Secure Your Spring Boot Application