Join us for an informative one-hour webinar focused on API security, tailored for beginners. In this session, you will gain valuable insights into the OWASP API Security Top 10 risks and learn how to effectively detect vulnerabilities in GraphQL-powered APIs using Postman. Our webinar will explore key topics such as Server-Side Request Forgery, Broken Object property Level Authorization, and unsafe consumption of APIs that could expose sensitive business flows.

Whether you're a developer, security professional, or simply interested in API security, this beginner-friendly webinar is designed to equip you with the knowledge and skills to build secure and reliable APIs using Postman.

Links shared during the webinar:
- OWASP [ Ссылка ]
- OWASP API Top Ten List for 2023 [ Ссылка ]

The vulnerable version of GraphQL we used in the webinar:
- [ Ссылка ]
The Postman collection we used to show these vulnerabilities
- postman.com/devrel/workspace/graphql-security-101/collection/645d1d33d3f0b63ec09ffb98

Other links we shared:
- GraphQL Server Fingerprinting Tool: [ Ссылка ]
- OWASP GraphQL Cheatsheet: [ Ссылка ]
- Brute-Force a GraphQL Schema: [ Ссылка ]
- Defending graphql apis: [ Ссылка ]
- GraphQL Voyager: [ Ссылка ]
- Brute-force Password Payload List: [ Ссылка ]
- GraphQL Threat Matrix: [ Ссылка ]

00:00 Introductions
01:55 Live poll about background and experience of attendees
04:32 Agenda and Learning Objectives
06:03 What is API Security
07:00 OWASP API Top Ten background and 2023 list of security concerns
08:00 Digging into 4 OWASP vulnerabilities:
08:01 - Broken Object Property Level Authorization (BOLA)
10:52 - Server-Side Request Forgery (SSRF)
11:53 - Unrestricted Access to Sensitive Business Flows
12:45 - Unsafe Consumption of APIs
14:05 Quick introduction to GraphQL
16:48 Common GraphQL attack vectors
20:30 Demonstration of a vulnerable version of GraphQL using Postman
22:17 - Introspection using GraphQL Voyager
24:45 - Information Disclosure using "field suggestion" using Clairvoyance
25:59 - Denial of Service attacks through overloading queries, and batch query attacks, circular fragments and more
29:02 - More DOS attacks using query recursion
31:20 - More DOS attacks using field duplication
32:44 - More DOS attacks with aliasing queries
33:50 - Looking at GraphQL client libraries and their vulnerabilities in the GraphQL Threat Matrix
34:46 - Last DOS attack with circular fragments
35:55 How to prevent exploits on GraphQL using the OWASP GraphQL Cheatsheet
37:40 Examining Server-side Request Forgery (SSRF) attacks
40:53 Using Postman to run a collection of endpoints with testing for compliance checks
45:15 Additional learning resources and upcoming Intergalactic Sessions
47:47 Q&A and wrap-up

#api #security #bola #ssrf #graphql

свернуть