The API Assessment Primer
summary
APIs routinely expose concrete failures not concepts: mobile backends return full user lists or password hashes, login requests go over plain HTTP, and an IoT study finds 5 to 25 vulnerabilities per app. Practical tools are required—capture runtime traffic with proxies or Wireshark, replay with HTTP editors or Burp/ZAP, and scan ciphers with SSLscan. Attack methods that consistently work include fuzz all parameters and enumerate undocumented verbs; secret leakage via API keys in binaries frequently leads to real compromise and bills.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 0:47Agenda
- 1:13Greg Patton Introduction
- 1:56Why is API security important
- 2:56Security is often overlooked
- 4:36Key things to consider
- 5:48Things to collect
- 6:44Two key things
- 8:06HTTP
- 10:53Common Things
- 14:22Testing Steps
- 15:22Developer Tips
- 16:07Information Leakage
- 17:02RSA Mobile
- 17:55Review API Responses
- 18:54Mobile App Example
- 20:00Things to Consider
- 20:20Hidden Functionality
- 21:04Other Verbs
- 21:56Protection
- 22:40Access Control
- 26:13Transport Security
- 28:32Injection Concerns
- 30:05Fuzzing
- 30:36Validate Parameters
- 31:11Manage API Keys
- 31:59Mobile Application Assessment
- 32:27Key Management
- 34:39Takeaways
- 35:22Least Privilege
- 35:55Resources
- 36:28Contact Greg
- 37:00References
- 37:17Questions
related talks
26mOffensive API Penetration Testing
25mHow Do They Get In?! Understanding the API Attack Vector
01h 29mAPI Vulnerabilities and What to Do About Them
35mClosing Keynote Day 1 API First Hacking
31mAPI security
19mProtect Your Digital Assets: Spot and Secure Open APIs Quickly
35mHow to Break API's
01h 00mLandmines in the API Landscape