How To Hack An API In 15 Minutes

The talk starts from the premise that most attackers do not need sophisticated methods. They want a quick win, often within about 15 minutes, against data that is easy to reach. The speaker contrasts this opportunistic behaviour with security researchers who spend long periods on novel bugs. He then walks through a series of mobile app incidents from recent years, where apps exposed APIs without authentication or authorization checks, sometimes leaking entire user databases.

The core method is a repeatable workflow. An app is pulled from a public store and unpacked, and a short Python script extracts the API endpoints it calls. The key step is comparing two versions of the same app, so that only newly added endpoints are tested. These are the least likely to have been reviewed by security teams. Each endpoint is requested without credentials, and a successful response indicates exposure. The same approach is applied to open cloud storage referenced by mobile apps, and hardcoded keys found in app code are ranked by how much damage they could cause.

For defenders, the takeaways are to maintain a complete inventory of APIs, including undocumented ones, to review every unauthenticated endpoint, to keep secrets out of client code, and to audit cloud storage permissions. The speaker notes that mobile release practices often lag behind server-side development, which can leave gaps. In the closing questions, he discusses automating discovery by watching app stores for new releases.