APIs Exposed!
summary
Covers OWASP Top 10 risks and concrete mitigations: demos show Postman firing 25 requests against an ASP.NET Core API and an AspNetCoreRateLimit package enforcing 20 requests per 30s so the first 20 return 200 OK and requests 21–25 return 429; explains progressive delays, CAPTCHA and MFA, and risks of reverse brute force. Shows SQL injection payloads like "' OR 1=1; DROP TABLE users;" and warns JWTs are signed not encrypted so payloads must not contain secrets; describes CSRF double-submit and use of HTTPOnly cookies.
AI-written summary · about
chapters (7)
- 0:00Start
- 8:51PREVENTING BAUTE FORCE ATTACKS
- 15:02PREVENTING ODOS ATTACKS
- 26:37PREVENTING XSS ATTACKS
- 29:06SOL INJECTION ATTACKS
- 34:02PREVENTING CSRF ATTACKS
- 44:51API SECURITY
related talks
46mAPI Security – Divide & Conquer
26mOffensive API Penetration Testing
58mASP.NET Core meets OWASP Top 10 2025
01h 29mAPI Vulnerabilities and What to Do About Them
22mAPI Security Testing with Postman: Best Practices and Techniques
51mHarmonizing the OWASP API and Application Top 10 Lists
30mAPI Security - Divide & Conquer
30mBOLA, IDOR, MA, BFLA. Welcome to the OWASP API Top 10!