Posts on api-security
5 posts on api-security. Notes from public sources and my own test lab.
Beyond IDOR: Logic Flaws and Invisible Doors in the API World
A deep dive into BOLA (Broken Object Level Authorization) and why modern security is no longer just about firewalls, but about the logic within our endpoints.
Leaving the API Doors Unlocked: Did You Really Think a JWT Was Enough?
Have you ever felt that cold sweat down your neck when you realize your API is serving your entire database to the internet? Let's talk about the most common 'invisible' vulnerability: BOLA.
JSON’s Backdoor: The Forgotten 'Logic' and Invisible Threats in API Security
Modern security isn't just about blocking scripts; it's about understanding the logic of your APIs. Let's dive into why WAFs aren't enough when your business logic is broken.
The Silent Danger Hidden Between JSON Packets: API Logic Errors and Mass Assignment
In the modern web, the real danger isn't always a complex script; sometimes it's just an extra field in a JSON packet. Let's explore Mass Assignment and how to secure your APIs.
Unlocking Invisible Doors: IDOR and the Silent Guests at API Backdoors
Ever seen someone else's invoice just by changing a number in the URL? That's IDOR. Let’s look at why this 'old but gold' vulnerability still haunts modern APIs and how we can secure our systems.