AI-generated with SlideGen
API Security Fundamentals & Pentesting Reconnaissance
A 2-hour internal technical workshop covering API security fundamentals and pentesting reconnaissance methodologies.
11 slides·25 views
API Security Fundamentals & Pentesting Reconnaissance
API Security Fundamentals
Pentesting Reconnaissance Workshop
1 / 11
API Security Fundamentals
Pentesting Reconnaissance Workshop
API Security Fundamentals & Pentesting Reconnaissance1 / 11
Module 1: API Foundations & Architecture
Section summary or transition context...
API Security Fundamentals & Pentesting Reconnaissance2 / 11
Welcome and Workshop Objectives
Slide subtitle or context (optional)...
- ●Workshop: API Security Fundamentals
- ●Covering API fundamentals and architecture
- ●Traffic interception and request anatomy
- ●Authentication and authorization mechanics
- ●Pentesting reconnaissance methodology
- ●Active exploitation is out of scope today
API Security Fundamentals & Pentesting Reconnaissance3 / 11
What is an API and Why Use It?
Slide subtitle or context (optional)...
- ●API: Application Programming Interface
- ●Contract for software components to communicate
- ●Decouples front-end from back-end logic
- ●Enables microservices architecture
- ●One back-end, many consumers (web, mobile, IoT)
- ●API is often the actual attack surface
API Security Fundamentals & Pentesting Reconnaissance4 / 11
Web Application API Architecture
REST Conventions and Status Codes
01
Client (SPA/Mobile)
Browser loads JS, JS calls APIs directly
02
API Gateway
Handles rate limiting, auth, routing
03
Reverse Proxy
Distributes requests to services
04
Microservices/Backend
Independent, scalable business logic
API Security Fundamentals & Pentesting Reconnaissance5 / 11
Key API Security Metrics
Slide subtitle or context (optional)...
30% YoYAPI Traffic Growth
2x in 2023API Attack Volume
70% of incidentsData Breaches via API
45% of attack surfaceUndocumented APIs
API Security Fundamentals & Pentesting Reconnaissance6 / 11
Common API Attack Vectors
Slide subtitle or context (optional)...
Total100
Percentage of API Incidents (OWASP API Top 10)
Broken Object Level Auth
35%Broken User Auth
20%Excessive Data Exposure
15%Lack of Rate Limiting
15%Improper Assets Management
15%API Security Fundamentals & Pentesting Reconnaissance7 / 11
Base URLs Versus Endpoints
Understanding URL Components
- ●Base URL: Root address of the API
- ●Example: https://api.example.com/v2
- ●Endpoint: Specific path for resource/action
- ●Example: /users/42
- ●Path parameters: Part of URL structure (/users/{id})
- ●Query parameters: Appended after ?, for filtering
- ●Example: ?include=orders
- ●Full URL: https://api.example.com/v2/users/42?include=orders
API Security Fundamentals & Pentesting Reconnaissance8 / 11
Interactive Quiz Time
Slide subtitle or context (optional)...
- ●Which HTTP verb is idempotent and safe?
- ●Difference between path and query parameters?
- ●Identify URL components: https://shop.io/api/v3/cart/9?coupon=SAVE10
- ●What do 403 and 401 status codes mean?
API Security Fundamentals & Pentesting Reconnaissance9 / 11
Module 2: Request Anatomy & Traffic Access Modes
Section summary or transition context...
API Security Fundamentals & Pentesting Reconnaissance10 / 11
Thank You for Attending!
Questions and Discussion
API Security Fundamentals & Pentesting Reconnaissance11 / 11