API Authentication Deep Dive: OAuth 2.0, Tokens, and JWTs
summary
Covers OAuth 2.0, API tokens and JWTs with a live hacking demo against the intentionally vulnerable crappy API using Postman, Burp Suite repeater, jwt.io and jwt-tool. Creates two accounts, inspects an HS512 JWT, tries alg=none (server rejects), builds a 5‑char crunch wordlist (~12 million candidates), cracks the secret as "crappy", self‑signs tokens and gains access to both accounts. Recommends rate limiting, high‑entropy secrets and never storing tokens in plaintext or developer notes.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:15Introduction Agenda
- 1:14OWASP API Top 10 Overview
- 2:15API Authentication Basics
- 6:18Common Authentication Vulnerabilities
- 7:02JWT Token Components Explained
- 7:55JWT Misconfigurations Issues
- 9:33Live Demo: API Security
- 21:05Securing API Authentication
- 22:05Closing Remarks
related talks
47mThe Hacker's Guide to JWT Security
37mThe Hacker's Guide to JWT Security
31mThe Hacker's Guide to JWT Security
48mThe Hacker's Guide to JWT Security
43mThe Hacker's Guide to JWT Security
44mAll your APIs are mine - Secure them now
59m{JWT}.{Misuse}.&Abuse
33mBreaking Tokens: Modern Attacks on OAuth, OIDC, and JWT Auth Flows