Opening Keynote – Tushar Kulkarni
summary
Open-source vapi demonstrates concrete API failures: a Dockerized Laravel + MySQL app with a Postman collection, Kubernetes support and live instance at rapid.grouptest.com. Reproductions show broken object level authorization (change ID to read admin data and retrieve a flag) and a JWT alg=none exploit (tamper payload to escalate to admin); mass-assignment and excessive-data examples map to OWASP API Top 10. Tools used: Postman, Burp Suite/OWASP ZAP, jwt.io and brute-force JWT utilities. Report cites 90% of web attack surface and $578M investment in API security.
AI-written summary · about
chapters (17)
- 0:00Keynote introduction
- 0:44APIs as web app backbone
- 1:30Modern web architecture risks
- 4:46API security investment growth
- 5:07Shift to API-driven apps
- 7:15APIs as attack vector
- 7:57OWASP API 2019 top vulns
- 13:00API security best practices
- 17:38OWASP API Top 10 2023
- 18:41Introducing VAPI project
- 20:09VAPI technical stack
- 22:14Live demo of VAPI vulns
- 27:26Broken object level auth
- 31:03JWT token manipulation
- 36:42More VAPI vulnerabilities
- 37:02API security resources
- 39:07Q&A
related talks
23mTopics of Interest: vAPI: Vulnerable Adversely Programmed Interface (API Top 10)
26mOffensive API Penetration Testing
46mAPI Security – Divide & Conquer
45mAPI Security: Acting Now to Enable Security Controls
01h 29mAPI Vulnerabilities and What to Do About Them
15mJumpstart Security & Penetration Testing APIs
44mAll your APIs are mine - Secure them now
01h 00mLandmines in the API Landscape