Automating API Penetration Testing using fuzzapi - AppSecUSA 2016

Recorded at AppSecUSA 2016 in Washington, DC
2016.appsecusa...
Automating API Penetration Testing using fuzzapi
Despite the widespread use of REST API calls using various frameworks, security researchers continue to discover many vulnerabilities in APIs. Vulnerabilities are frequently found in the APIs of applications produced by even the most mature development teams - which include internet giants Facebook, Google and Microsoft etc.
Where do the developers fail? After studying several API vulnerabilities across the internet, the main problem our team has identified is that developers often have little understanding of how to write or implement secure REST APIs. Most fail while trying to solve the complexity of writing APIs for web and mobile platforms simultaneously. Another significant problem the team has identified is that most DevOp engineers and Penetration testers have no standard platform that provides coverage of common vulnerabilities typically found in APIs. It has been a challenge for penetration testers to practice security testing on APIs across multiple platforms in the absence of such vulnerable applications.
Our project is trying to address this problem for the broader community by developing a platform to better understand and practice testing for the most common API vulnerabilities. Rather than a tool that only identifies vulnerabilities in web services, we have built a platform that enables everyone to test and understand a large range of API vulnerabilities that exist in both web and mobile applications.
As part of this presentation, our team will release an API Fuzzer as an OWASP Project to help developers test the APIs they develop during the early stages of the SDLC. The tool can be integrated into the build pipeline to allow developers to identify vulnerabilities prior to Pen Testing. Also, Pen testers can also use this tool against various APIs during their testing which will allow them to automate few tasks.
Speakers
Abhijeth Dugginapeddi
Abhijeth D(@abhijeth) is a security Consultant working for a bank in Australia. Previously worked with Adobe Systems, TCS and Sourcenxt. Security Enthusiast in the fields of Penetration Testing, Application/Mobile/Infrastructure Security. Believes in need for more security awareness and free responsible disclosures.
Lalith Rallabhandi
Lalith Rallabhandi (@lalithr95) currently works as a Developer Intern at Shopify. He has previously worked with Hackerrank, Zomato and Google Summer of Code. Likes to code, break stuff mostly with web applications and is a Ruby on rails Enthusiast. Found bugs with Google, Microsoft, Facebook, Badoo, Twitter etc.
-
Managed by the official OWASP Media Project www.owasp.org/...

[@Azamkhan-qi2fk]

Very informative video 👍

[@ShritamBhowmick]

How about handling authentication tokens & automate the rest with spidering features?

[@sakonachhoeurng6149]

៦66៦៥66

[@devsathish2126]

How to feed REST request with client certificate ?

[@jayaramkrishnakumar68]

I hope it would be better if we have a vm (vmdk,vdi) which is already installed with fuzzapi . we can host the image in sourceforge or any services like Gdrive or ondrive or mega etc.

[@wiref4lcon246]

Check the github - they have a docker container that you can run in your Kali Linux