König: Bridging WebAPI Fuzzing with a Graph
Poh Cai Min and Shawn Pang examines grammar-based fuzzing made painless.
Summary
Architecture and Background
Poh Cai Min, Shawn Pang present 'König: Bridging WebAPI Fuzzing with a Graph' at DEF CON SG1 CSIT Village, detailing technical frameworks, attack surfaces, and core methodologies in fuzzing, api-security, grammar-fuzzing, web-security.
Vulnerability Analysis
The technical analysis dissects structural design flaws, protocol vulnerabilities, and edge cases uncovered during rigorous research.
Exploitation and Demonstrations
Grammar-based fuzzing made painless! This talk highlights how the generation of grammar files for browser WebAPIs can be automated and visualised with the help of a network graph.
Remediation and Defensive Strategies
Security practitioners and defenders receive actionable defensive controls, hardened configurations, and threat detection strategies to mitigate impact.
Related talks
War Stories·34 min
Ben Sadeghipour · Corben Leo
Ben Sadeghipour (NahamSec) and Corben Leo share war stories from high-impact bug bounty engagements across prisons, major tech firms, and online casinos.
Main Stage·24 min
Gregory Pickett
Demonstrates how fundamental architectural design flaws in backend APIs create exploitable vulnerabilities no patch can fully address.
Main Stage·44 min
John Menerick
John Menerick details open Source Fairy Dust John Menerick SECURITY RESEARCHER, NETSUITE Over the past 30 years, the Internet and open source software have worked in tandem.