apidays LIVE India 2022: Accelerating India’s digitisation with APIs May 11 & 12, 2022 Offensive API Penetration Testing Sunny Singh, Lead Security Engineer at Calibo ------------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/ Deep dive into the API industry with our reports: https://www.apidays.global/industry-reports/ Subscribe to our global newsletter: https://apidays.typeform.com/to/i1MPEW

1. API Penetration Testing
O f f e n s i v e
A P I d a y s 2 0 2 2

2. 2022 SERIES OF EVENTS
New York
JULY
(HYBRID)
Australia
SEPTEMBER
(HYBRID)
Singapore
APRIL
(VIRTUAL)
Helsinki & North
MARCH
(VIRTUAL)
Paris
DECEMBER
(HYBRID)
London
OCTOBER
(HYBRID)
Hong Kong
AUGUST
(VIRTUAL)
JUNE (VIRTUAL)
India
MAY
(VIRTUAL)
APRIL (VIRTUAL)
Dubai & Middle East
JUNE
(VIRTUAL)
Check out our API Conferences
www.apidays.global
Want to talk at one of our conferences?
apidays.typeform.com/to/ILJeAaV8

3. Lead Security Engineer | Calibo
Principal Security Engineer | cybert.in
Lead Consultant | Skyewall
Bug Bounty Hunter
#Whoami
Sunny Singh

4. Resources
OWASP
Tools
Lab Setup
Introduction
Contents

5. APIs are mechanisms that enable two software components to
communicate with each other using a set of definitions and
protocols.
API security is the process of protecting APIs from attacks. Because
APIs are very commonly used, and because they enable access to
sensitive software functions and data, they are becoming a primary
target for attackers. API security is a key component of modern web
application security.
Introduction

6. • SOAP
• REST
• GraphQL
Types of APIs

7. vAPI - https://github.com/roottusk/vapi
vAPI is Vulnerable Adversely Programmed Interface
which is Self-Hostable API that mimics OWASP API Top 10
scenarios through Exercises.
VAmPI - https://github.com/erev0s/VAmPI
Vulnerable REST API with OWASP top 10 vulnerabilities
for APIs
REST API Goat - https://github.com/optiv/rest-api-goat
This is a "Goat" project so you can get familiar with REST
API testing
Lab Setup

8. Burp Suite - https://portswigger.net/burp
Postman / Swagger
APIFuzzer - https://github.com/KissPeter/APIFuzzer
Kiterunner - https://github.com/assetnote/kiterunner
Ffuf - https://github.com/ffuf/ffuf
Automatic API Attack tool - https://github.com/imperva/automatic-
api-attack-tool
Burp Extensions:
InQL - https://github.com/doyensec/inql
Wsdler - https://github.com/NetSPI/Wsdler
Tools

9. API1:2019 — Broken object level authorization
API2:2019 — Broken authentication
API3:2019 — Excessive data exposure
API4:2019 — Lack of resources and rate limiting
API5:2019 — Broken function level authorization
API6:2019 — Mass assignment
API7:2019 — Security misconfiguration
API8:2019 — Injection
API9:2019 — Improper assets management
API10:2019 — Insufficient logging and monitoring
OWASP API Top 10

10. https://apisecurity.io/
https://github.com/Kara-4search/NewNtdllBypassInlineHook_CSharp
https://github.com/qeeqbox/social-analyzer
https://github.com/RhinoSecurityLabs/Swagger-EZ
https://github.com/arainho/awesome-api-security
https://github.com/inonshk/31-days-of-API-Security-Tips
https://github.com/az0mb13/Chopin
Resources

11. THANK YOU