I’m an API Hacker and Here’s How I Hack Everything from the Military to AI
summary
Finds four real bugs: an airport booking API that accepts just a last name and lets anyone edit runway length (missing auth/authorization), a quiz mobile app that sends answers inside batched mobile requests allowing free Amazon gift cards, a GraphQL multipart upload that maps to a Jackson Databind deserialization CVE (GraphQL multipart deserialization), and common Laravel mistakes like omitted middleware or a missing authorization if-statement that permit destructive actions. Fixes: enforce auth, check resource ownership, document APIs, add pipelines and vulnerability SLAs.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:28Career Journey
- 4:19API Hacking Focus
- 5:32Silly Bug Story
- 9:35Fast Bug Story
- 12:06Complex Bug Story
- 12:57Vulnerability Analysis
- 15:49Why APIs are Vulnerable
- 19:02Code-Level Issues
- 23:12Development Culture
- 24:55Teamwork and Security
- 26:02Future Mitigation Steps
- 30:17Q&A Session
related talks
21mHow to hack an Angular app?
53mHacking And Defending APIs: Red And Blue Make Purple
01h 29mAPI Vulnerabilities and What to Do About Them
30mAPI Security - Divide & Conquer
46mAPI Security – Divide & Conquer
53mOpening Keynote – Dr. Katie Paxton-Fear
41mLive Hacking: Breaking into Your Web App
35mClosing Keynote Day 1 API First Hacking