WEBVTT

0:00:09.400000 --> 0:00:14.880000
 Hello everyone and welcome to the
 API penetration testing course.

0:00:14.880000 --> 0:00:19.140000
 Before we get started with this course,
 as you probably already know,

0:00:19.140000 --> 0:00:24.340000
 I always like providing you with an
 overview of the course that sort of

0:00:24.340000 --> 0:00:27.880000
 gives you a high level overview.

0:00:27.880000 --> 0:00:32.000000
 You know, if everything will be covering
 so that you know what to expect.

0:00:32.000000 --> 0:00:34.800000
 And the idea is, as I said, very simple.

0:00:34.800000 --> 0:00:38.900000
 Just give you an idea of what to expect
 and then we'll touch on some of

0:00:38.900000 --> 0:00:41.520000
 the learning outcomes.

0:00:41.520000 --> 0:00:46.220000
 So what you will know and what you'll
 be able to do by the end of the

0:00:46.220000 --> 0:00:50.520000
 course and will also come, will
 also cover some prerequisites.

0:00:50.520000 --> 0:00:54.260000
 But first, let's get some of the
 formalities out of the way.

0:00:54.260000 --> 0:00:56.940000
 Who am I? My name is Alexis Ahmed.

0:00:56.940000 --> 0:00:59.020000
 I'm the offensive security already.

0:00:59.020000 --> 0:01:00.880000
 I'm instructor here at tiny.

0:01:00.880000 --> 0:01:03.820000
 I'm also a red team lead at Hackersploit.


0:01:03.820000 --> 0:01:08.140000
 So that's a little bit about myself.

0:01:08.140000 --> 0:01:11.580000
 And now that we have that out of the
 way, let's take a look at some key

0:01:11.580000 --> 0:01:16.640000
 concepts. We will be covering
 in this course.

0:01:16.640000 --> 0:01:20.840000
 So this will sort of give you an idea
 as to, you know, from the perspective

0:01:20.840000 --> 0:01:25.660000
 of concepts. What will be focusing
 on or what the focus of this course

0:01:25.660000 --> 0:01:30.420000
 is going to be. So firstly, you know,
 an introduction to web services

0:01:30.420000 --> 0:01:34.420000
 and API. So the idea is to introduce
 you to APIs formally.

0:01:34.420000 --> 0:01:39.420000
 So, you know, what is an API or I should
 say firstly, what is a web service

0:01:39.420000 --> 0:01:44.580000
 and then why web services were created
 and then how that led to the creation

0:01:44.580000 --> 0:01:50.340000
 of the API. You know, what APIs
 are used for how they work.

0:01:50.340000 --> 0:01:56.240000
 And more importantly, you know, the
 different variations API's come in

0:01:56.240000 --> 0:02:00.480000
 in in in in in in different ways.

0:02:00.480000 --> 0:02:03.820000
 So, you know, we'll be focusing on,
 you know, the architectural side.

0:02:03.820000 --> 0:02:08.220000
 So, you know, what types of APIs we have.


0:02:08.220000 --> 0:02:11.280000
 So rest, GraphQL, you
 know, stuff like this.

0:02:11.280000 --> 0:02:13.760000
 And then, you know, we'll also take
 a look at the implementations.

0:02:13.760000 --> 0:02:19.080000
 So, you know, implementing a REST
 API for specific function.

0:02:19.080000 --> 0:02:23.740000
 And the basic idea is, you know, to get
 this formal understanding of what

0:02:23.740000 --> 0:02:29.840000
 APIs are and how they are used, you
 know, on the web or in conjunction

0:02:29.840000 --> 0:02:35.400000
 with web applications, what they're
 typically used for, etc.

0:02:35.400000 --> 0:02:39.640000
 We'll then turn our attention logically
 to, you know, web API security.

0:02:39.640000 --> 0:02:45.580000
 So, given that web, given that web APIs
 are, you know, prevalent on the

0:02:45.580000 --> 0:02:49.000000
 Internet and, you know, a lot
 of organizations use them.

0:02:49.000000 --> 0:02:55.620000
 We need to understand, you know, the
 process of securing APIs, what it's

0:02:55.620000 --> 0:03:02.840000
 been historically and what out of that,
 what vulnerabilities have arisen.

0:03:02.840000 --> 0:03:08.140000
 And, you know, you'll see that they're
 quite similar to what you'd expect

0:03:08.140000 --> 0:03:12.320000
 or what you'd find on web applications,
 you know, traditional web applications.

0:03:12.320000 --> 0:03:18.600000
 And this will then lead us into the
 OASP Top 10 Web API security risks

0:03:18.600000 --> 0:03:23.020000
 that will sort of give you an idea and understanding
 of the common vulnerabilities

0:03:23.020000 --> 0:03:28.120000
 and will sort of understand, you know,
 where they're typically found,

0:03:28.120000 --> 0:03:31.120000
 what causes them, and of course,
 how to look for them.

0:03:31.120000 --> 0:03:34.120000
 We'll then turn our attention
 to API reconnaissance.

0:03:34.120000 --> 0:03:38.920000
 So, this section or this, what we'll
 be dealing with here is the process

0:03:38.920000 --> 0:03:43.960000
 of, you know, performing reconnaissance,
 you know, both passive and active

0:03:43.960000 --> 0:03:51.220000
 and, you know, performing, you know,
 doing stuff that involves, you know,

0:03:51.220000 --> 0:03:57.060000
 API end point analysis, discovering
 API end points, fuzzing, so on and

0:03:57.060000 --> 0:04:03.820000
 so forth. We'll then turn our attention
 to API authentication testing.

0:04:03.820000 --> 0:04:06.480000
 So, you know, one of the things you'll
 discover in this course, if you're

0:04:06.480000 --> 0:04:11.840000
 not familiar with APIs, already is that,
 you know, it goes without saying

0:04:11.840000 --> 0:04:15.820000
 that if you have an API or anything
 on the Internet, you're most likely

0:04:15.820000 --> 0:04:19.500000
 going to have an authentication
 mechanism that is securing it.

0:04:19.500000 --> 0:04:23.420000
 And as a result, we need to start exploring
 or we will need to explore

0:04:23.420000 --> 0:04:28.260000
 the process of testing these authentication
 mechanisms or, you know, authentication

0:04:28.260000 --> 0:04:30.180000
 security and APIs.

0:04:30.180000 --> 0:04:32.260000
 And that's going to be our focus there.

0:04:32.260000 --> 0:04:37.080000
 And then, of course, we'll also explore
 a set of other vulnerabilities,

0:04:37.080000 --> 0:04:41.400000
 but more specifically or more importantly,
 the injection vulnerabilities

0:04:41.400000 --> 0:04:44.900000
 and, you know, the different
 forms that those come in.

0:04:44.900000 --> 0:04:46.920000
 So, you know, what do
 you typically expect?

0:04:46.920000 --> 0:04:52.020000
 Command injection vulnerabilities, SQL
 injection vulnerabilities, stuff

0:04:52.020000 --> 0:04:56.360000
 like this. So, turning our attention
 to the major topics, they essentially

0:04:56.360000 --> 0:05:02.280000
 revolve around, you know, the
 major or the key concept.

0:05:02.280000 --> 0:05:06.000000
 But just to break it down, we, you know,
 we have the fundamentals of web

0:05:06.000000 --> 0:05:09.200000
 services and APIs, web API security.

0:05:09.200000 --> 0:05:12.980000
 We'll also be exploring, you know, throughout
 the entirety of the course

0:05:12.980000 --> 0:05:18.920000
 an API pen testing methodology, API
 reconnaissance, as I mentioned, API

0:05:18.920000 --> 0:05:22.860000
 authentication testing and API
 injection vulnerabilities.

0:05:22.860000 --> 0:05:26.600000
 But now that brings us to an important
 section, which is the learning

0:05:26.600000 --> 0:05:30.200000
 outcome. So, this is where I list out what
 you will know and more importantly,

0:05:30.200000 --> 0:05:34.080000
 what you'll be able to do
 by the end of the course.

0:05:34.080000 --> 0:05:38.840000
 So, firstly, understand the purpose
 and structures of APIs, including

0:05:38.840000 --> 0:05:44.560000
 REST, SOAP and GraphQL, recognize common
 API security risks and their

0:05:44.560000 --> 0:05:50.500000
 impact. Apply systematic methodology
 for API penetration testing, perform

0:05:50.500000 --> 0:05:55.180000
 reconnaissance to discover API endpoints
 and resources, test API authentication

0:05:55.180000 --> 0:06:00.480000
 mechanisms for vulnerabilities, and,
 of course, identify and exploit API

0:06:00.480000 --> 0:06:02.620000
 injection vulnerabilities.

0:06:02.620000 --> 0:06:06.540000
 This then brings us to the prerequisites
 and there really are two that

0:06:06.540000 --> 0:06:08.940000
 I would sort of hold true.

0:06:08.940000 --> 0:06:13.180000
 Firstly, you know, I would recommend that
 you have, you have, you're familiar

0:06:13.180000 --> 0:06:17.300000
 with the OASP top 10 and the OASP web
 security testing guide, given though

0:06:17.300000 --> 0:06:21.440000
 it doesn't really apply
 or play a major role.

0:06:21.440000 --> 0:06:25.560000
 Understanding some of the nomenclature,
 I think is quite important.

0:06:25.560000 --> 0:06:29.040000
 And of course, goes without saying
 that by this point, you should have

0:06:29.040000 --> 0:06:34.720000
 experience in using web proxies like BERP
 Suite and ZAP or any other alternative,

0:06:34.720000 --> 0:06:38.880000
 as long as you know how to intercept
 requests, modify them, you should

0:06:38.880000 --> 0:06:43.280000
 be good. So, with that being said,
 that's the course overview.

0:06:43.280000 --> 0:06:47.320000
 I'm really excited to get started with
 this course and with that being

0:06:47.320000 --> 0:06:50.340000
 said, I'll be seeing you
 in the first video.