API Hijacking.pdf
- 1. API Hijacking By : Vishwas Narayan API Security Practitioner,Community Advocate Opstree Business Logic Easy Attack Vector
- 2. Know your Resources โ Don't Open Secrets in the API documentation โ Keep the API Docs in Email Authentication not open โ Documents that say what is the API is until you feel there is a new security patch that has to be done โ Fix the API as soon as possible
- 3. Know your Situation โUnderstand what is the business logic before you open the API that you feel its secureโ
- 4. Know your Adversary/Enemy โHack your APIโs before hacker knows how hack itโ โ You need to know the next move โ You need to make moves before a stranger makes it
- 5. OWASP Top 10 in API Security 1. Broken Object Level Authorization 2. Broken User Authentication 3. Excessive Data Exposure 4. Lack of Resources & Rate Limiting 5. Broken Function Level Authorization 6. Mass Assignment 7. Security Miscon๏ฌguration 8. Injection 9. Improper Assets Management 10. Insu๏ฌcient Logging & Monitoring OWASP API Security Project | OWASP Foundation
- 6. Summarising issues in API โ Authentication/Session Management โ Authorization/Access Control/IDOR โ Inputs and Output Validation/Error Handling โ Rate Limiting/Throttling
- 7. Let's worship this โ Global state of the internet security DDoS attack reports | Akamai โ How to send API key in the header of python request? - Stack Overflow โ Postman Sending Request onto the API โ Postman Sending AUTH token โ Automating the postman Calls โ Akamai State of the Internet Report โ Salt Security releases Salt Labs State of API Security Report, Q3 2022
- 8. DOMO Report 9.0 Data Never Sleeps 9.0 | Domo
- 10. ALL report says one thing you architect the api wrong way guess what world will show you how it can be
- 11. Common APIโs 1. APIโs 2. Open API 3. Public API 4. External API 5. Internal API 6. Swaggers 7. Rest API 8. SOAP 9. Graphql 10. Machine to Machine API 11. BETA ,Pre Production,Production API 12. Third Party 13. Composite API
- 12. Unknown APIโs 1. Zombie API 2. Shadow API 3. Frankenstein API
- 14. What is cURL and how does it relate to APIs? - IBM Developer The turtle and the Bunny (animation) by VirtualSketcher on DeviantArt
- 15. dsopas/MindAPI: Organize your API security assessment by using MindAPI. It's free and open for community collaboration. (github.com)
- 24. assetnote/kiterunner: Contextual Content Discovery Tool (github.com)
- 25. MobSF/Mobile-Security-Framework-MobSF: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. (github.com)
- 26. Thank you lets go Handson