Course 2 - API Security Offence and Defense | Episode 4: Aggressive Attacks, Traditional Vulnerabilities and Exploitation of Staging APIs | CyberCode Academy

In this lesson, you’ll learn about:

Aggressive Attacks on APIs
- Denial of Service (DoS): Flooding servers to disrupt service; Layer 7 attacks mimic normal users.
- Brute Force: Guessing secrets like passwords, JWTs, tokens, or 2FA codes.
- Mitigation: Rate limiting, authentication for heavy processes, short expiration for secrets, complex codes, caching, load balancing, restricting direct IP access.
Targeting Non-Production APIs
- Development, staging, and deprecated APIs often lack proper security.
- Risks include exposed debugging info, weaker policies, and connection to production databases.
- Mitigation: Delete deprecated APIs, restrict access (passwords/IP), enforce production-level security policies, include in penetration testing scope.
Traditional Web Vulnerabilities in APIs
- IDOR: Manipulate object IDs in URLs to access unauthorized data.
- XSS: Only exploitable if content type allows JavaScript execution.
- SQL Injection: Unexpected results indicate query manipulation.
- Remote Code Execution (RCE): 500 errors from unusual input may signal server or OS-level vulnerabilities.
Key Takeaway:
APIs must be protected from both API-specific threats and classic web vulnerabilities, with consistent security policies across all environments.

You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy

Course 2 - API Security Offence and Defense | Episode 4: Aggressive Attacks, Traditional Vulnerabilities and Exploitation of Staging APIs