Protect Your Digital Assets: Spot and Secure Open APIs Quickly
summary
Shows that attackers decrypt mobile apps, run an automated diff to find shadow APIs introduced in a new release, and hit those endpoints with tools like API Hunter to pull PII in under 15 minutes. Claims 35+ public exploit cases and cites a 2021 finding that ~two‑thirds of breaches come from unauthenticated APIs. Also locates embedded cloud keys and tokens that grant mass access, demonstrates scripted extraction of names, SSNs and passwords, and confirms the approach works end‑to‑end.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:50Importance of 15 Minutes
- 3:14Comparing Security Researchers and Hackers
- 6:23Understanding BOLA Attacks
- 8:25Methods Hackers Use on APIs
- 14:50Essential Security Tools
- 15:12Bonus: Cloud Resources Security
- 18:10Conclusion of Presentation
related talks
26mHack Your APIs in 15 Minutes or Less
35mClosing Keynote Day 1 API First Hacking
31mHow I hacked 30 mobile banking apps & the future of API Security
39mThe API Assessment Primer
19mAvoid These API Security Pitfalls: Expert Insights
24mMobile - Your API Security Blindspot
25mHow Do They Get In?! Understanding the API Attack Vector
50mAttackers want your data and they're getting it from your API