Navigating the depths of API security testing
summary
Shows how to scan OpenAPI specs and run targeted dynamic tests against a running Node.js API (Docker Compose) using a 42Crunch VS Code plugin and CI steps (GitHub Actions/Azure DevOps). Demonstrates finding broken object-level authorization (delete and edit without owner checks), excessive data exposure (shipping API: partial ID + postal code exposes PII), brute-forceable IDs and 6‑digit reset codes (smart scale), and a crypto asset spoof allowing unauthorized sells—fixes are added checks and rate limiting.
AI-written summary · about
chapters (6)
- 0:00Introduction and agenda
- 4:07Why API security matters
- 8:10Real-world breach examples
- 22:15Automating API security
- 28:45Live security testing demo
- 45:25Q&A and concluding remarks
related talks
46mAPI Security – Divide & Conquer
45mAPI Security: Acting Now to Enable Security Controls
08mAutomated Security Testing for JS Apps
15mJumpstart Security & Penetration Testing APIs
35mHow to Break API's
45mOpening Keynote – Tushar Kulkarni
53mHacking And Defending APIs: Red And Blue Make Purple
55mAPI Security Assurance via E2E Testing