Top 10 API Bugs (and Where to Find Them)

In this video I go over the Top 10 API Bugs published by the OWASP API Security project. Although published for the blue team/security teams there's some great info for bug bounty hunters! So let's break it down, what are the bugs, where can we find them and how do we exploit them. Did you know this episode was sponsored by Intigriti? Sign up with my link go.intigriti.com/katie I'm so pleased with everyone's positive response to the Intigriti sponsorship and I'm so pleased you folks are finding bugs and even finding your first bugs! Thank you for being awesome! This episode is a companion to last week's video, hopefully you spend some time this week doing some recon, collecting some endpoints, now I'm going to show you how to exploit them :D! Also check out my demo where I show you these bugs in action, which is going to be live streamed later today! If you are watching this in the future, it'll be on my channel. Do you want to support me? Why not buy me a coffee? ko-fi.com/insiderphd Got questions? I have answers, Tweet at me twitter.com/InsiderPhD Further Reading: - OWASP API Top 10: owasp.org/www-project-api-security/ - OWASP API Top 10 Explained: apisecurity.io/encyclopedia/content/owasp/owasp-ap… - Some possible misconfigurations: apisecurity.io/encyclopedia/content/owasp/api7-sec… - Misconfiguration - CORS: blog.detectify.com/2018/04/26/cors-misconfiguratio… - Misconfiguration CSRF:    • Finding Your First Bug: Cross-Site Re...  

• #education
• #api_security
• #api
• #security
• #api_security_testing
• #api_hacking
• #api_hacking_tutorial
• #api_hacking_bug_bounty
• #bug_bounty
• #bug_bounty_hunting
• #how_to_get_started_in_bug_bounty
• #api_bug_bounty
• #api_bug_hunting
• #owasp_top_10
• #owasp_api_top_10