Common Application Security Mistakes that Enable Automated Attacks
summary
Analysis of billions of transactions finds concrete root causes: exposed swagger and wp json specs, forgotten v1 endpoints, verbose error messages, predictable gift card numbers and token preguessing that enable credential stuffing and inventory or seat spinning attacks. Practical tooling and numbers appear — Kite Runner for spec harvesting, Burp/ZAP for automated validation, a 2,000 customer platform test and a 90 day disclosure with lithium and Ciao Now. A free discovery service from sequence.ai is coming to enumerate leaking endpoints.
AI-written summary · about
chapters (13)
- 0:00Automated bot attacks intro
- 1:03Why bots target apps
- 3:13API spec discovery
- 5:19Account takeover risks
- 7:05Inventory attacks
- 9:35Stock flaws and waiting rooms
- 12:27Why automation succeeds
- 13:51Forgotten endpoints enable attacks
- 15:58Excessive API data exposure
- 20:56Forgotten endpoints and user behavior
- 24:44Securing API docs and errors
- 26:07OWASP CRAPY best practices
- 27:09Q&A
related talks
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
55mBreaking and Fixing Web Application Security
30mAPI Security - Divide & Conquer
15mJumpstart Security & Penetration Testing APIs
52mApplication Security at DevOps Speed and portfolio scale
46mApplication security from start to finish
41mVulnerabilities that Hide from your Tools
52mKnock Knock: Understanding Who is Using Your Web Applications