Category - API Security Blog

SAST tools are not designed for API-centric applications and as such do a poor job of detecting vulnerabilities within them.

API Security testing is different from web app security testing The OWASP Top 10 list for APIs includes the following: Cross Site Request Forgery (CSRF), Broken Authentication and Session Managemen ...

September 17, 2021

Bookstore is a boot2root CTF machine that teaches a beginner penetration tester basic web enumeration and REST API Fuzzing.

Several hints can be found when enumerating the services, the idea is to understand how a vulnerable API can be exploited, you can contact me on twitter @sidchn_20 for giving any feedback regarding t ...

September 17, 2021

If you want to know whats going on with the new Star Wars movies, this is your book.

I am a huge fan of the original three Star Wars films (the prequels are not my jam). I have seen them all many times over and own multiple copies of each one. I also really enjoy the Expanded Universe ...

September 17, 2021

The government is suing AT&T for fraud, claiming that it has been overcharging the US for years

The government is suing AT&T for fraud, claiming that it has been overcharging the US for years https://t.co/vflV1EiKLF ...

September 17, 2021

use cryptographically secure randomizers to generate long random values.

tl;dr: use a recommended safe hashing algorithm for hash-based tokens/secrets. When you are using an API, your client will be the one making requests to it. If you are writing an application that use ...

September 17, 2021

I dont think its a good idea to make your own game engine.

The reason I say this is because the amount of time you spend on making an engine will be much more than the time you spend on actually making games with that engine. And if you want to make money fro ...

September 17, 2021

Salt is the best in API security.

Salt Is The Best In API Security Again! Its one thing for us at Salt to say were the best in API security its quite another for the team at API World to say it. And they just did. Fiserv, ...

September 17, 2021

CloudVector provides a flexible security policy based on Parameter Pinning, which accurately identifies API calls that misuse this vulnerability and automatically protects against this threat by terminating the API session.

Broken Access Control API access control is critical to protect sensitive data from unauthorized users. For example, an attacker can use stolen authentication tokens or brute force attacks to gai ...

September 17, 2021