[Walkthroughs] TryHackMe room 'OWASP API Security Top 10 - 1' Writeup

[Walkthroughs] TryHackMe room "OWASP API Security Top 10 - 1" Writeup

Learn the basic concepts for secure API development (Part 1).
OWASP - Open Web Application Security Project (OWASP) is a non-profit and collaborative online community that aims to improve application security via a set of security principles, articles, documentation etc. Back in 2019, OWASP released a list of the top 10 API vulnerabilities, which will be discussed in detail, along with its potential impact and a few effective mitigation measures.

We have split this room into two parts. In Part 1, you will study the top 5 principles, and in Part 2 (coming soon), you will learn the remaining principles.

Learning Objectives

Best practices for API authorisation & authentication.
Identification of authorisation level issues.
Handling excessive data exposure.
Lack of resources and rate-limiting issues.

My Contact Details

[Colaholiker]

Task 4 is pretty mean. It tells you to to add a header called "Authorisation-Token" to the request when querying the details. However, as we see in the video, it needs to be "Authorization-Token". But that's not the first time that the mix of American and British spelling on THM threw me off.

[HackerOne-sbqg]

How are you copying and pasting from the vm?