Offensive API Penetration Testing
summary
Explains why APIs are primary attack surfaces and lists the OWASP API Top 10 (2019) with concrete examples: broken object-level authorization, broken authentication, excessive data exposure, missing rate limits, injections and mass assignment. Recommends hands-on tooling: Postman and Burp Suite for interception and manipulation, Kiterunner and API fuzzers (and Imperva’s automatic API scanner) to discover hidden endpoints. Prescribes fixes: OAuth + RBAC, API gateway rate limiting, WAF, shift-left scanning in CI/CD, encryption at rest and a zero‑trust posture.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:08Agenda
- 2:48What are APIs
- 4:00Types of APIs
- 4:47Practice
- 5:44Tools
- 8:43API Attacks
- 10:39Broken Authentication
