API-ocalypse

Jennifer Shannon opens with a short primer on APIs, describing them as a way for web services to expose functions to other computers. She points to the OWASP API Top 10, noting that most of its entries involve authentication or authorization, and says API testing has grown from an occasional task into a routine part of her work.

The core of the talk is a live walkthrough against a deliberately vulnerable API running in a pentesting virtual machine. Using Postman to send requests and Burp Suite Community Edition to intercept and replay them, she works through a series of endpoints. Changing a user ID returns other people's accounts, which shows missing object-level authorization. Supplying extra fields when creating an account sets credits and an administrator flag, a mass assignment flaw. A crafted value in a login field bypasses the check and returns an admin token through SQL injection. An older versioned endpoint with a weak rate limit is shown to be brute-forceable.

She closes with audience questions. She says homegrown APIs fail far more often than carefully built ones, and compares REST with GraphQL, where batching and deeply nested queries bring denial-of-service and username enumeration risks. Her takeaways are to check authorization on every object, never trust client input, retire old API versions, and keep secrets such as API keys out of URLs.