Hacking and Defending APIs - Red and Blue make Purple.

The talk argues that APIs are now the main route to sensitive data, and that they often sit outside the controls teams have built for browser-based applications. Scripted clients cannot pass multi-factor prompts or browser profiling checks, and API inventories are often incomplete. Defenders need to know each endpoint's host, path and HTTP method to judge how risky it is.

The middle section follows a penetration testing workflow: passive and active reconnaissance, discovery of how an API is meant to be called, then attacks drawn from the OWASP API Top 10. For each category the speaker shows the attacker's approach, such as swapping object IDs to test broken object level authorization, probing unlisted methods for function-level flaws, or adding unexpected fields to trigger mass assignment. Each attack is paired with its defensive view, comparing posture management, runtime monitoring and testing. Fuzzing, structural data attacks and a brief look at GraphQL round out the section.

The closing takeaways suggest that testers can reuse much of their web testing knowledge but need API-specific tools, while defenders should combine a live inventory, runtime detection and early testing. A community-maintained list of API security tools is also referenced for further study.