Crash Course into the OWASP API Top 10

At this month’s meeting, Alan will preview his upcoming SnowFROC talk, Crash Course into the OWASP API Top 10. As a DC303 exclusive complimenting the talk, we will practice on the vulnerable applications Completely Ridiculous API (crAPI) and VAPI.

To participate in the interactive part of the event, bring your own laptop with an intercepting proxy (Burp, ZAP, etc.) as well as an API testing tool like Postman. There will be several options for accessing the labs, including using API Sec University’s hosted environment, a local Proxmox lab network we will host in the space for the event, or setting up your own VMs on your laptop.

Recommended Tools:

https://portswigger.net/burp/communitydownload
https://www.zaproxy.org/
https://www.postman.com/
https://github.com/OWASP/crApi (or alternative to deploying a VM: http://crapi.apisec.ai/)
https://github.com/roottusk/vapi (or alternative to deploying a VM: http://vapi.apisec.ai/)

Talk Abstract:

Application Programming Interfaces (APIs) are the glue that allows independently evolving systems to communicate with each other, and are an important focus for security investment due to their privileged access to sensitive data and functionality. Recently, the OWASP API Top 10 has been updated for 2023, so join us as we introduce the OWASP API Security Project. We’ll cover what’s new in the 2023 API Top 10, as well as compare the differences with the previous 2019 version. For those interested in hands-on practice, we’ll also briefly introduce the OWASP crAPI (completely ridiculous API) Project which demonstrates common API vulnerabilities.