INTERFACE by apidays 2023 APIs for a “Smart” economy. Embedding AI to deliver Smart APIs and turn into an exponential organization June 28 & 29, 2023 Reverse Engineering Undocumented APIs Dana Epp, Security Engineer, Security Researcher (and Influencer) at Vulscan ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. How to reverse engineer an
undocumented API
Dana Epp
dana.epp@owasp.org

3. ABOUT ME :
Microsoft Security MVP | Microsoft Regional Director
Security Engineer | Security Researcher
danaepp.com

4. JOIN THE API HACKER INNER CIRCLE
https://apihacker.blog

5. APPSEC VIA OFFSEC =

6. QUESTION :
WHY ARE WE HERE TODAY?

7. API PUBLISHERS UPDATE THEIR DOCS
LESS THAN TWICE A YEAR
48%
Source: Salt Security - https://salt.security/api-security-trends

8. UPDATE API FAR MORE FREQUENTLY
THAN THEIR DOCS ARE UPDATED
83%
Source: Salt Security - https://salt.security/api-security-trends

9. SEE THE PROBLEM?

10. QUESTION :
WHAT IS API DOCUMENTION?

11. OpenAPI / SWAGGER :
AN API DESCRIPTION FORMAT FOR REST APIs

12. QUESTION :
ARE API DOCUMENTS ONLY FOR DEVELOPERS?

13. QUESTION :
WHY CRAFT YOUR OWN API DOCUMENTS?

14. THE DARK ART OF ROGUE API DOCS

15. TEAMING UP DURING PENTESTING
NETSEC + APPSEC =

16. Capture API traffic through devtools

17. Configure network capture

18. Use the web app as normal…

19. Use the web app as normal…
API
User
Funcs
Admin
Funcs
Premium
Funcs

20. Generate a HTTP Archive (HAR)…

21. Generate OpenAPI definition file
using mitmproxy2swagger
mitmproxy2swagger -i crapi.apisec.ai.har -o
crapi.yaml -p http://crapi.apisec.ai -e -f har

22. Edit definition file (yaml)

23. Edit definition file

24. Generate OpenAPI documentation
by running mitmproxy2swagger again
mitmproxy2swagger -i crapi.apisec.ai.har -o
crapi.yaml -p http://crapi.apisec.ai -e -f har

25. Open yaml definition file again…

26. Open yaml definition file again…

27. Check it with editor.swagger.io

28. Check it with editor.swagger.io

29. Import into Postman

30. Use Postman as REST client

31. Configure Postman to proxy
through Burp Suite

32. Send Requests in PostMan…
Attack API in Burp Suite

33. How to generate and use
rogue API documents
HAR capture
Generate
YAML
Edit YAML
Generate
OpenAPI
doc
Import to
Postman
Attack API
with
BurpSuite
mi t mpr oxy2s wagger
Br ows er
(devtools)
Vi s ual St udi o Code
(or any text editor)

35. ADVANCED RECON WITH DELTA DIFFS!

36. JOIN THE API HACKER INNER CIRCLE
https://apihacker.blog

37. Q&A
Dana Epp
dana.epp@owasp.org