INTERFACE by apidays 2023 - Reverse Engineering Undocumented APIs, Dana Epp, Vulscan

INTERFACE by apidays 2023
APIs for a “Smart” economy. Embedding AI to deliver Smart APIs and turn into an exponential organization
June 28 & 29, 2023

Reverse Engineering Undocumented APIs
Dana Epp, Security Engineer, Security Researcher (and Influencer) at Vulscan

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. How to reverse engineer an undocumented API Dana Epp dana.epp@owasp.org
3. ABOUT ME : Microsoft Security MVP | Microsoft Regional Director Security Engineer | Security Researcher danaepp.com
4. JOIN THE API HACKER INNER CIRCLE https://apihacker.blog
5. APPSEC VIA OFFSEC =
6. QUESTION : WHY ARE WE HERE TODAY?
7. API PUBLISHERS UPDATE THEIR DOCS LESS THAN TWICE A YEAR 48% Source: Salt Security - https://salt.security/api-security-trends
8. UPDATE API FAR MORE FREQUENTLY THAN THEIR DOCS ARE UPDATED 83% Source: Salt Security - https://salt.security/api-security-trends
9. SEE THE PROBLEM?
10. QUESTION : WHAT IS API DOCUMENTION?
11. OpenAPI / SWAGGER : AN API DESCRIPTION FORMAT FOR REST APIs
12. QUESTION : ARE API DOCUMENTS ONLY FOR DEVELOPERS?
13. QUESTION : WHY CRAFT YOUR OWN API DOCUMENTS?
14. THE DARK ART OF ROGUE API DOCS
15. TEAMING UP DURING PENTESTING NETSEC + APPSEC =
16. Capture API traffic through devtools
17. Configure network capture
18. Use the web app as normal…
19. Use the web app as normal… API User Funcs Admin Funcs Premium Funcs
20. Generate a HTTP Archive (HAR)…
21. Generate OpenAPI definition file using mitmproxy2swagger mitmproxy2swagger -i crapi.apisec.ai.har -o crapi.yaml -p http://crapi.apisec.ai -e -f har
22. Edit definition file (yaml)
23. Edit definition file
24. Generate OpenAPI documentation by running mitmproxy2swagger again mitmproxy2swagger -i crapi.apisec.ai.har -o crapi.yaml -p http://crapi.apisec.ai -e -f har
25. Open yaml definition file again…
26. Open yaml definition file again…
27. Check it with editor.swagger.io
28. Check it with editor.swagger.io
29. Import into Postman
30. Use Postman as REST client
31. Configure Postman to proxy through Burp Suite
32. Send Requests in PostMan… Attack API in Burp Suite
33. How to generate and use rogue API documents HAR capture Generate YAML Edit YAML Generate OpenAPI doc Import to Postman Attack API with BurpSuite mi t mpr oxy2s wagger Br ows er (devtools) Vi s ual St udi o Code (or any text editor)
35. ADVANCED RECON WITH DELTA DIFFS!
36. JOIN THE API HACKER INNER CIRCLE https://apihacker.blog
37. Q & A Dana Epp dana.epp@owasp.org