Hack Your APIs in 15 Minutes or Less
summary
Claims that hackers routinely exfiltrate large volumes of data from Shadow APIs in about 15 minutes by decrypting an app, decompiling it, and extracting URLs; proof includes examples like 63redsafe and multiple mobile apps leaking names emails and SSNs. The team demos a released tool called API Hunter (python script) that dumps strings, regexes for URLs, then connects to validate endpoints and diffs new endpoints between app versions. Reported impact: two thirds of cloud breaches trace to misconfigured APIs, and the automated method works at scale.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:26Hack in 15 Minutes or Less
- 2:06What do hackers do
- 2:37Research vs Hacking
- 5:50How to defeat Machine Learning
- 7:08Construction worker example
- 7:56API security
- 8:15API security in the news
- 8:59API security in Australia
- 9:29Same attack different app
- 10:35misconfigured APIs
- 12:10how did this happen
- 13:47Detecting APIs
- 15:28The Clever Part
- 18:23Data Breaches
- 19:53Science of the Tools
- 24:09Conclusion
related talks
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
31mHow I hacked 30 mobile banking apps & the future of API Security
35mClosing Keynote Day 1 API First Hacking
15mDo not live in the Shadow (APIs)
39mThe API Assessment Primer
25mHow Do They Get In?! Understanding the API Attack Vector
29mScorthter, Hacking Banks and Cryptocurrency Exchanges through their APIs
50mAttackers want your data and they're getting it from your API