APIsec

Announcing One Request to Rule Them All! ????♀? ??? ?? ?? ??♂? ?? APIsec is putting over $10,000 (USD) in prizes behind this competition! The first person to win by making The One Request will receive a $5,000 cash prize and there will be additional prizes for the top ten winners. Register here: https://lnkd.in/gKHkCuGs When: February 27th at 3:30 PM EST and will be available through March 2nd 5 PM EST. I'll be sharing additional details about One Request at APISEC|CON API Testing. (https://lnkd.in/gfPiYqya) One Request is a new API CTF series. I dreamt up this competition and designed it a few years ago. Now it is finally coming to fruition! All you have to do is make the one request and you win! The problem, that any API hacker is familiar with, is gathering all of the correct parameters and authorization to make that one request. GLHF!!! All made possible because of APIsec University APIsec, and Maltek Solutions, LLC Brodie Davis Michael Lisi Dan Barahona Christine Stevenson Bevilacqua Faizel Lakhani

?? 100,000 students and counting! ?? APIsec University just hit a HUGE milestone—over 100,000 students learning how to secure APIs! ?? From developers to security engineers, teams across the world (including over 75% of the Fortune 100) are leveling up their API security skills with free courses. This is proof that API security is no longer optional—it’s a must-have skill. ?? To celebrate, we’re offering 50% of all APIsec University exams through the end of February! If you’ve been thinking about getting certified, now is the time. Use this coupon code: AU100K ?? Thank you to our community for making APIsec University the #1 place to learn API security! And huge thank you our leader, Corey J. Ball, to Christine Stevenson Bevilacqua for making this site a reality, and to our awesome instructors: Anthony Aragues, Gabrielle B., Jason Harmon, Jacob Ideskog, Teresa Pereira, Shaked Edri, Tom Kaplan, Mareko (Kay) James, Aubrey King, Erik Wilde, Audrey Kolski, Jeremy Glassenberg, Mike Amundsen, Ilona Koren-Deutsch. #APIsecurity #Cybersecurity #DevSecOps #Learning #Milestone #APIsec

?? Earn your first APIsec University badge of 2025! ?? Join API expert and tech leader Abhijit Dey TODAY at 12pm ET for a deep dive into API Product Development. ?? What we’ll explore: *Defining the purpose of your API *Managing the full API lifecycle *Growth strategies for scaling *Ensuring strong security *Monetization and driving market adoption Whether you're a developer, product manager, or business leader, this session is for anyone looking to unlock the potential of APIs for innovation and growth. ?? Register now: https://lnkd.in/ec9a3vHU

APIs are critical for modern online services, but they can also be a gateway for cyberattacks. Programs like customer loyalty rewards are prime targets, turning companies into "accidental banks" with valuable customer data. In one case, over $100,000 in fraud was uncovered due to API abuse in just 24 hours. More from Forbes here: https://ow.ly/qBAw50TQXWx

OWASP Villain #7... Loki! Loki’s ability to deceive, manipulate, and gain access to restricted areas is a metaphor for how SSRF attacks abuse a server's trust and access levels, making him an apt representation of this vulnerability.

The Internet Archive suffered its third cyberattack in October 2024, as hackers exploited unrotated API tokens to access its Zendesk support platform, potentially exposing sensitive user data. This follows earlier breaches, underscoring vulnerabilities in the Archive’s security. The incident highlights the critical need for stronger cybersecurity measures to protect user information. Read more: https://lnkd.in/eGgMa5BQ

Researchers have uncovered a cryptojacking campaign targeting Docker Engine API vulnerabilities. Attackers use Docker Swarm for command-and-control, deploying cryptocurrency miners and spreading malware across networks. By exploiting exposed Docker API endpoints, they launch malicious containers and hide their activity using rootkits. This highlights the critical need to secure Docker and Kubernetes environments to prevent rapid malware spread and botnet creation. Read more: https://ow.ly/VYxQ50TMQkU

OWASP Villain #6... Lex Luthor! Lex Luthor represents OWASP API Security Risk #6, Unrestricted Access to Sensitive Business Flows, by exploiting weaknesses and manipulating systems for his benefit. Just as Lex gains unauthorized power and manipulates critical processes, attackers can exploit APIs with unprotected business flows to perform unauthorized actions, disrupt operations, or take control of systems. #APISecOWASPVillains

OWASP Villain #5... Rogue from X-men! Her ability to absorb others' powers, identities, and access to abilities that aren’t hers by default is similar to Broken Function Level Authorization, which allows an attacker to exploit insufficient access control. Rogue can bypass normal restrictions and use powers she shouldn’t have access to. #APIsecOWASPVillains

Many thanks to Dan Barahona for inviting me to try out APIsec's API vulnerability scanner. I have been discovering its potential, it has allowed me to map an API in seconds from its specification file, discover its most sensitive endpoints and launch a large battery of tests. A promising tool and one that will give a lot to talk about :-) #hackingapis #api #apisec