Skip to content

summary.en.md

Latest commit

 

History

History
87 lines (69 loc) · 8.25 KB

summary.en.md

File metadata and controls

87 lines (69 loc) · 8.25 KB

API security OWASP top 10 : TryHackMe

Disclaimer: This is a personal summary and interpretation based on a YouTube video. It is not official material and not endorsed by the original creator. All rights remain with the respective creators.

AI-Powered buttons

Teach Me: 5 Years Old | Beginner | Intermediate | Advanced | (reset auto redirect)

Learn Differently: Analogy | Storytelling | Cheatsheet | Mindmap | Flashcards | Practical Projects | Code Examples | Common Mistakes

Check Understanding: Generate Quiz | Interview Me | Refactor Challenge | Assessment Rubric | Next Steps

This document summarizes the key takeaways from the video. I highly recommend watching the full video for visual context and coding demonstrations.

Before You Get Started

  • I summarize key points to help you learn and review quickly.
  • Simply click on Ask AI links to dive into any topic you want.

Introduction to API Security

  • Summary: APIs need to be treated with the same sensitivity as credentials or passwords due to their role in major attacks, like those affecting LinkedIn, Twitter, and Peloton users. The video covers the OWASP Top 10 for API security using a TryHackMe box, emphasizing that API documentation is crucial and not trivial.
  • Key Takeaway/Example: Major breaches involved millions of users' data exposed via APIs, such as 700 million LinkedIn records. Always reference API documentation for endpoints, required inputs, and expected outputs.
  • Link for More Details: Ask AI: API Security Introduction

What is an API?

  • Summary: An API acts as a middleman for communication between applications, like a phone app talking to DoorDash or a script fetching data from Shodan. It simplifies data retrieval without needing complex user interactions, using requests to endpoints with authorization like tokens or headers.
  • Key Takeaway/Example: Without APIs, scripts would mimic user actions on websites, which is complex. APIs validate requests and return data in formats like JSON, but must be secured to prevent unauthorized access.
  • Link for More Details: Ask AI: What is an API

Broken Object Level Authorization (BOLA/IDOR)

  • Summary: BOLA, or Insecure Direct Object Reference (IDOR), occurs when APIs allow direct access to objects via identifiers without proper authorization, enabling attackers to enumerate users or data they shouldn't access.
  • Key Takeaway/Example: Using curl or tools like Burp, an attacker can iterate through user IDs (e.g., /user/1, /user/2) to list all users, facilitating password sprays. Fix by implementing authorization tokens that validate user access.
  • Link for More Details: Ask AI: Broken Object Level Authorization

Broken User Authentication

  • Summary: This vulnerability arises from flawed authentication mechanisms, like not validating passwords, allowing attackers to obtain tokens easily if they have user lists from other flaws.
  • Key Takeaway/Example: An endpoint might check only email, returning a token without password verification. Use the token in subsequent requests to access user details. Fix by validating both email and password in login queries.
  • Link for More Details: Ask AI: Broken User Authentication

Excessive Data Exposure

  • Summary: APIs return more data than necessary, such as device IDs, latitudes, and longitudes in comments, due to assumptions that front-end will filter it, leading to privacy risks.
  • Key Takeaway/Example: Querying a comment endpoint exposes unnecessary fields like location. Mitigate by ensuring back-end only returns required data, not relying on front-end filtering or network-level controls alone.
  • Link for More Details: Ask AI: Excessive Data Exposure

Lack of Resources and Rate Limiting

  • Summary: Without rate limits, APIs can be abused for denial-of-service attacks, like flooding email resets, causing crashes, resource exhaustion, or reputational harm from spam flags.
  • Key Takeaway/Example: Repeatedly calling an OTP send endpoint without limits can send millions of emails. Implement limits like waiting periods (e.g., 2 minutes) and define max data sizes to prevent overuse.
  • Link for More Details: Ask AI: Lack of Resources and Rate Limiting

Broken Function Level Authorization

  • Summary: Low-privilege users can access admin functions by manipulating headers, like setting "is_admin" to true, due to lack of proper role checks against the database.
  • Key Takeaway/Example: Adding a header allows listing all users as admin. Use role-based access control, deny by default, and verify roles in the backend, not just headers or hidden fields.
  • Link for More Details: Ask AI: Broken Function Level Authorization

About the summarizer

I'm Ali Sol, a Backend Developer. Learn more: