The OWASP Top 10 API security outlines the most common attacks that occur against APIs and provides tips on protecting your API from these threats.

1. top10 APISecurityRisks
OWASP

2. APIs without
authen�ca�on
api/userID/20905
api/userID/20804
BOB
John
This is when API returns sensi�ve
data to a user who doesn’t have permission
to access that data
01 01 01 01
01 01 01 01
01 01 01 01
01 01 01 01
01 01 01 01
01 01 01 01
01 01 01 01
01 01 01 01
API1:2019 Broken Object-Level Authorization

3. This is when API returns sensi�ve data to a user
who doesn’t have permission to access that data
A�acker
API Endpoints
<>
<>
<>
<>
<>
<>
<>
<>
Uses creden�al
stuffing with stolen
password database
API2:2019 Broken User Authentication

4. This is when API is designed to expose
all sensi�ve data without proper filtering
Sam
GET /api/userprofile
Applica�on
Server
Database
Server
{ [Name: Sam..
Card No.: 1234
SSN: 709-99-789,
Name: John..
Card No.: 5467
SSN: 237-71-567,
...] }
709-99-7890
Sam
1234 5678 9012 3456
DOB 709-99-7890
API3:2019 Excessive Data Exposure

5. When there is no restric�on on
the number of requests made by
users, APIs can be vulnerable to
brute force and DDoS a�acks
!
API4:2019 Lack of Resources & Rate Limiting

6. GET/accounts/emp1/account_detail
GET/accounts/emp2/account_detail
Alex
A�acker
What if i replace
emp1 with emp2 and view
someone else’s data
This is when an API allows users to use
HTTP methods to execute func�ons, they
are unauthorized to perform
API5:2019 Broken Function Level Authorization

7. Trust us for
Web Applica�on and API Protec�on
Start your free trial at indusface.com/api

8. POST/order/coupon
...
{”coupon_code”:
{”welcome10”,
”welcome10”,
”welcome10”,
...]
}
200 OK
...
{”Order_value”:”0$”}
A�ack Scenario
E-Commerce site
Normal Scenario
POST/order/coupon
...
{”coupon_code”:”welcome10”}
200 OK
...
{”order_value”:”90$”}
E-Commerce site
It occurs when an
API takes user input
directly and maps the
values to the backend
object models without
proper filtering
API6:2019 Mass Assignment

9. An API component is
suscep�ble to a�ack
due to a nonsecure
configura�on op�on
Unhardened Images
HTTP headers
HTTP
CORS
Open files and folders
Verbose errors
API7:2019 Security Misconfiguration

10. A�ackers send malicious data to an
API that passes it into the database
User
A�acker
Server
Select * from users
WHERE userID =’1199’
and password = ‘secretpw’;
Select * from users
WHERE userID =’1199’
and password = “or 1=1;
User ID :
Password :
API8:2019 Injection

11. A�ackers may break into the current API by exploi�ng
the vulnerability on the staging API if le� unmanaged
Beta
API
Produc�on
API
API9:2019 Improper Assets Management

12. It occurs when there are no recording details about
auditable events inside an API
Properly Set Up Logging
New Threat Detected!
Insufficient Logging
All Good! ATTACK IN
PROGRESS
My User Name
LOG IN
Forgot Password
API10:2019 Insufficient Logging & Monitoring

13. Scan & Protect Your APIs Today!
API
Discovery
API Vulnerability
Scanning
DDoS & Bot
Mi�ga�on
API Pen
Tes�ng
Start your free trial at indusface.com/api
OWASP Top 10
Protec�on