Fundamentals of Hacking Web API's скачать в хорошем качестве

Fundamentals of Hacking Web API's

Penetration Testing Web Application Penetration Testing Ransomware Readiness Assessment Mobile App Assessment Remote Access Assessment Purple Team Red Team & Adversary Emulation Let our offense, prepare your defense. getoffensive@redsiege.com ______________________________________________________________ Today, Red Siege breaks down the fundamentals of hacking web API's SiegeCast: "WEB API WEAKNESSES" Presented by Charles Shirer ( @bsdbandit ) Penetration testing Web API's can be difficult without an effective approach, so Charles Shirer is here to provide you with a few tips and tricks! Charles breaks down the fundamentals of hacking Web API's and the methodology that he has used during his career to perform successful and effective Web API penetration tests over the years. Slides: https://redsiege.com/webapi Follow Us Twitter:   / ​   Facebook:   / ​   Linkedin:   / reds​.  . _______________________________________________________ Red Siege Founder: Tim Medin (tim@redsiege.com) Twitter: @timmedin Red Siege is an information security consulting company that concentrates on the latest threats to organizations today. We perform in-depth analysis, determine organization/business risk, and find the vulnerabilities before the bad guys do. Our team includes internationally renowned experts who have been featured in international news outlets and conferences, including The Wall Street Journal, The Washington Post, a News Channel Asia Documentary. https://redsiege.com​ #hacking​ #infosec​ #webapi #webapp 00:00 Web API Weaknesses 00:27 About Charles 1:07 Hacking Web API's 1:36 Types of Web API's 3:10 What is Rest API? 4:10 Rest API Testing Approach 5:47 Understand the API Attack Surface 8:40 API Documentation 9:09 Broken Authentication 9:28 Authentication Bypass 10:58 Testing for SQL Injection 13:13 Validate the Response 14:24 Test for IDOR Attacks 16:27 Test for XML Attacks 16:58 What is XML Injection? 17:15 Test for XML Injection 18:03 XXE Injection Attack 20:02 Testing Brute Force 21:09 Abusing Lack of Rate Limiting 23:22 Finding Sensitive Data Using Get Requests 24:57 Find Post & Put Requests for Endpoints 26:26 API Security Misconfiguration 28:12 Automated API Fuzzing 30:25 Automated Fuzzing Using Astra 31:50 Automated Fuzzing Using FuzzAPI 33:55 Learning Resources 34:58 Practice Resources 36:04 Questions