Fundamentals of Hacking Web API's

Penetration Testing
Web Application Penetration Testing
Ransomware Readiness Assessment
Mobile App Assessment
Remote Access Assessment
Purple Team
Red Team & Adversary Emulation

Let our offense, prepare your defense.
______________________________________________________________

Today, Red Siege breaks down the fundamentals of hacking web API's

SiegeCast: "WEB API WEAKNESSES"
Presented by
Charles Shirer ( @bsdbandit )

Penetration testing Web API's can be difficult without an effective approach, so Charles Shirer is here to provide you with a few tips and tricks! Charles breaks down the fundamentals of hacking Web API's and the methodology that he has used during his career to perform successful and effective Web API penetration tests over the years.

Follow Us

_______________________________________________________

Twitter: @timmedin

Red Siege is an information security consulting company that concentrates on the latest threats to organizations today. We perform in-depth analysis, determine organization/business risk, and find the vulnerabilities before the bad guys do. Our team includes internationally renowned experts who have been featured in international news outlets and conferences, including The Wall Street Journal, The Washington Post, a News Channel Asia Documentary.

#hacking​ #infosec​ #webapi #webapp

00:00 Web API Weaknesses
00:27 About Charles
1:07 Hacking Web API's
1:36 Types of Web API's
3:10 What is Rest API?
4:10 Rest API Testing Approach
5:47 Understand the API Attack Surface
8:40 API Documentation
9:09 Broken Authentication
9:28 Authentication Bypass
10:58 Testing for SQL Injection
13:13 Validate the Response
14:24 Test for IDOR Attacks
16:27 Test for XML Attacks
16:58 What is XML Injection?
17:15 Test for XML Injection
18:03 XXE Injection Attack
20:02 Testing Brute Force
21:09 Abusing Lack of Rate Limiting
23:22 Finding Sensitive Data Using Get Requests
24:57 Find Post & Put Requests for Endpoints
26:26 API Security Misconfiguration
28:12 Automated API Fuzzing
30:25 Automated Fuzzing Using Astra
31:50 Automated Fuzzing Using FuzzAPI
33:55 Learning Resources
34:58 Practice Resources
36:04 Questions

[nathanealisuru]

Damn!! A really good guide on API pentesting

[www]

nice video charles :) thanks. You seem cool as well

[abrahamcain]

Thanks for the video. I'm new to API testing and am trying to create a workflow and gain an understanding of APIs. I feel like this video gives a good place to start :)

[JuanBotes]

great energy like your presentation style - nice

[laurent]

But most of the time the version name is still "V1" even though it is upgraded .