API Security - Divide & Conquer
summary
Covers the OWASP API Top 10 with concrete exploits: BOLA (ID brute force) that let attackers pull millions of records from a carrier, VIN tampering to retrieve other vehicles’ health data, and a live Burp + Python proof‑of‑concept that rings thousands of shared scooters by iterating location and device IDs. Demonstrates root causes—excessive data exposure, missing rate limits, mass assignment, broken function‑level auth, weak logging—and shows tooling (Burp proxy, simple Python loop, Raspberry Pi) used to enumerate and abuse exposed endpoints.
AI-written summary · about
chapters (12)
- 0:00Intro
- 0:50About me
- 6:50API Security Top 10
- 14:16Json Throw
- 16:56Lack of Resource Rate Limiting
- 19:06Why is it so common
- 19:23Predictability
- 20:17Mass Assignment
- 21:10Exploit
- 22:29Security Misconfiguration
- 22:51Injection
- 23:07Documentation
related talks
46mAPI Security – Divide & Conquer
35mHow to Break API's
25mOWASP Top 10 for APIs
26mOffensive API Penetration Testing
25mHow Do They Get In?! Understanding the API Attack Vector
01h 29mAPI Vulnerabilities and What to Do About Them
35mClosing Keynote Day 1 API First Hacking
01h 00mLandmines in the API Landscape