API inSecurity TOP 10
Breaks down the OWASP API Security Top 10 vulnerabilities with real-world examples and remediation advice.
Summary
David Sopas and Paulo Silva, core contributors to the OWASP API Security Project, lead a guided tour through the OWASP API Security Top 10 in the AppSec Village [00:30, 00:37]. The speakers examine the paradigm shift toward decoupled single-page applications and mobile frontends that interact with distributed REST and GraphQL backends [06:38].
The presentation demonstrates real-world vulnerability scenarios, highlighting Broken Object Level Authorization (BOLA/IDOR) where cross-referencing identifiers across GraphQL queries and REST endpoints permits unauthorized data access [13:33, 13:46]. Sopas and Silva examine resource exhaustion and lack of rate limiting leading to user enumeration [20:44], mass assignment flaws, and improper asset management that leaves unpatched legacy API endpoints exposed to attackers [28:21].
(AI summary — Gemini Flash)
Related talks
Main Stage·33 min
Steve · Kristie Dunker
Steve and Kristie Dunker explores personal disaster prepardness at DEF CON 17, examining web-security and practical defenses.
Main Stage·49 min
Scott Moulton
Scott Moulton details rAID Recovery: Recover your PORN by Sight and Sound Scott Moulton Forensic Strategy Services, LLC.
Main Stage·36 min
Roberto Suggi Liverani · Nick Freeman
Roberto Suggi Liverani and Nick Freeman details abusing Firefox Addons Roberto Suggi Liverani Senior Security Consultant, Security-Assessment.