Malicious Uses of API Frameworks and Scanning Tools
summary
OpenAPI/Swagger-style API specification frameworks centralize API definitions, which helps development and security teams monitor conformance and reduce exploitable vulnerabilities. Centralization also makes those specifications easy for attackers to locate and enables a new generation of API scanning tools to find and abuse weaknesses. The talk examines how these frameworks and scanners are used maliciously against organizations.
AI-written summary · about
chapters (17)
- 0:00Start
- 3:59Breaches
- 5:59Standard Application Security Processes
- 8:01Api Documentation
- 8:37Api Spec Document
- 9:45Api Definitions
- 10:13Api Spec Documents
- 17:50Data Analytics on Api Endpoints
- 21:23Kite Runner
- 23:31Protections
- 24:23Graphql Default Endpoints
- 24:56Four Pillars of What Holds Up an Attack
- 31:39Replacing Defaults
- 33:04Recommendations
- 34:39Methods of Paths
- 41:15Mirai Botnet
- 41:58How Do You Discover an Api if There Is no Spec Published How
related talks
31mAPI security
48mAPI Security for Enterprises fireside chat
17mAPI Security Simplified: Practical Tips & Tools
26mOffensive API Penetration Testing
25mThe New API Vulnerability Frontier
24mAPI security, mitigate API abuses using machine learning
01h 29mAPI Vulnerabilities and What to Do About Them
25mAPIs for Scaling Enterprises: Setting and Applying API Standards.