API Security – Divide & Conquer
summary
Covers the OWASP API Security Top 10 with concrete examples, a live abuse demo and tooling: a vulnerable dvc-shop vulnerable C# app is attacked via Postman/Burp to show BOLA and broken function‑level authorization combined, where changing a JSON role field escalates a user to admin and allows deleting other accounts. Uses Checkmarks static analysis to find a missing object‑level authorization, fixes the code, and rescans to show the issue drops; emphasizes rate limiting, logging, and automating SAST in CI/CD.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 5:49How APIbased apps are different
- 12:01Attack surfaces
- 14:54Broken authentication
- 19:56Generic API
- 25:11Mass Assignments
- 26:24Remote Code Execution
- 27:28Security Misconfiguration
- 28:36Injection
- 30:00Improper Asset Management
- 30:56Documentation
- 32:21Logging Monitoring
- 33:35Live Abuse
- 34:36Architecture
- 38:37Admin Roles
- 39:10API Security
- 42:22API Vulnerability Detection
- 43:19Takeaways
- 44:06Training
related talks
30mAPI Security - Divide & Conquer
01h 29mAPI Vulnerabilities and What to Do About Them
23mTopics of Interest: vAPI: Vulnerable Adversely Programmed Interface (API Top 10)
26mOffensive API Penetration Testing
35mHow to Break API's
25mOWASP Top 10 for APIs
22mAPI Security Testing with Postman: Best Practices and Techniques
30mDon’t Worry, Be API: Addressing AppSec’s Newest Challenge