WEBVTT

0:00:04.060000 --> 0:00:10.180000
 Hello everyone and welcome to the API
 penetration testing course summary.

0:00:10.180000 --> 0:00:14.380000
 So this is the final video in the course
 and I think it's quite important

0:00:14.380000 --> 0:00:21.240000
 that before you guys leave and move on to
 another course or progress altogether

0:00:21.240000 --> 0:00:30.720000
 that we revisit what you learned.

0:00:30.720000 --> 0:00:35.560000
 You know, sort of give you an idea
 as to what new stuff you learned or

0:00:35.560000 --> 0:00:40.160000
 I should say what you have learned and
 what you should be able to do after

0:00:40.160000 --> 0:00:41.780000
 completing this course.

0:00:41.780000 --> 0:00:47.420000
 So if we revisit the key concepts that
 we are outlining the course overview,

0:00:47.420000 --> 0:00:52.340000
 you can see that we focused quite a bit
 of, you know, we add a whole section

0:00:52.340000 --> 0:00:56.980000
 on introduction to web services and APIs
 to give you a historical understanding

0:00:56.980000 --> 0:01:01.220000
 of where they came from, both web services
 and then the natural evolution

0:01:01.220000 --> 0:01:06.120000
 to APIs, the different types of implementations
 you're likely to run into,

0:01:06.120000 --> 0:01:10.820000
 how they're typically deployed,
 why they're deployed, etc.

0:01:10.820000 --> 0:01:14.660000
 And then of course we went through
 or gotten an introduction, a formal

0:01:14.660000 --> 0:01:17.300000
 introduction to API security.

0:01:17.300000 --> 0:01:23.580000
 So sort of understanding the history
 of APIs as well as the security of

0:01:23.580000 --> 0:01:28.360000
 the APIs, the common vulnerabilities,
 you know, that have plagued APIs

0:01:28.360000 --> 0:01:32.800000
 and then, you know, sort of giving you
 an offensive perspective on that

0:01:32.800000 --> 0:01:37.620000
 front. So we add that and then of course
 API reconnaissance, you know,

0:01:37.620000 --> 0:01:41.800000
 the process of performing both passive
 and active reconnaissance, identifying

0:01:41.800000 --> 0:01:48.560000
 endpoints, endpoints analysis,
 fuzzing, so on and so forth.

0:01:48.560000 --> 0:01:52.140000
 And then of course API authentication
 testing, we went over the process

0:01:52.140000 --> 0:01:57.100000
 of testing, you know, various forms
 or authentication mechanisms that

0:01:57.100000 --> 0:02:02.240000
 are, you know, typically paired with
 APIs or implemented in APIs, whether

0:02:02.240000 --> 0:02:06.280000
 that be token based authentication, so
 on and so forth, arguably the most

0:02:06.280000 --> 0:02:09.800000
 common. But we took a look at how to test
 for authentication based vulnerabilities

0:02:09.800000 --> 0:02:14.440000
 in APIs. And then finally, API injection
 vulnerabilities, where we covered,

0:02:14.440000 --> 0:02:18.460000
 you know, various types of injection
 vulnerabilities and how they apply

0:02:18.460000 --> 0:02:23.780000
 to API. So whether that be command
 injection or SQL injection.

0:02:23.780000 --> 0:02:28.160000
 So yeah, I think, you know, there's
 really no deviation, we covered a

0:02:28.160000 --> 0:02:29.720000
 lot more obviously.

0:02:29.720000 --> 0:02:31.980000
 But these are sort of the key concepts.

0:02:31.980000 --> 0:02:36.420000
 And then of course, if we revisit the
 linear outcomes, you know, this

0:02:36.420000 --> 0:02:40.860000
 is sort of where you get to actually
 verify whether, you know, you indeed

0:02:40.860000 --> 0:02:44.020000
 learned what you're supposed to and
 are able to do what you're supposed

0:02:44.020000 --> 0:02:49.020000
 to as we, you know, we originally
 outlined in the course of you.

0:02:49.020000 --> 0:02:52.500000
 So firstly, you know, understand the purpose
 and structures of API's including

0:02:52.500000 --> 0:02:54.680000
 REST, soap and Graph QL.

0:02:54.680000 --> 0:02:57.120000
 I think we covered that quite well.

0:02:57.120000 --> 0:03:00.940000
 By the end of the course, you should be
 able to recognize common API security

0:03:00.940000 --> 0:03:02.780000
 risks and the impact.

0:03:02.780000 --> 0:03:06.520000
 And of course, as I mentioned in the
 previous slide, when we're taking

0:03:06.520000 --> 0:03:10.520000
 a look at the key concepts, we had an
 entire section dedicated to that.

0:03:10.520000 --> 0:03:15.700000
 We also, you know, for the entirety of
 the course, we're sort of building

0:03:15.700000 --> 0:03:16.480000
 our methodology.

0:03:16.480000 --> 0:03:21.260000
 So I think we, we actually covered
 that quite well as well.

0:03:21.260000 --> 0:03:23.500000
 But we also did it at
 an operational level.

0:03:23.500000 --> 0:03:28.680000
 So actually implementing your methodology
 and then refining on it.

0:03:28.680000 --> 0:03:31.820000
 And then of course, you know, by the
 end of the course, you should be

0:03:31.820000 --> 0:03:35.760000
 able to perform reconnaissance, discover
 API and points and resources.

0:03:35.760000 --> 0:03:40.880000
 As I mentioned in the key concept section,
 we covered that quite in detail,

0:03:40.880000 --> 0:03:44.900000
 you know, both theoretically and practically,
 of course, we also, you

0:03:44.900000 --> 0:03:48.440000
 know, covered the process of testing
 API authentication mechanisms for

0:03:48.440000 --> 0:03:50.140000
 vulnerabilities.

0:03:50.140000 --> 0:03:53.980000
 And we then, you know, also explored
 the process of identifying exploiting

0:03:53.980000 --> 0:03:55.980000
 API injection vulnerabilities.

0:03:55.980000 --> 0:04:00.820000
 So this is what you should know and what
 you should be able to do in terms

0:04:00.820000 --> 0:04:03.400000
 of knowledge, skills and abilities
 by the end of this course.

0:04:03.400000 --> 0:04:07.240000
 And hopefully you concur that we actually
 covered what we were supposed

0:04:07.240000 --> 0:04:10.020000
 to quite well, I would say.

0:04:10.020000 --> 0:04:16.900000
 So now on to sort of give you a set of
 real world applications that applies

0:04:16.900000 --> 0:04:19.460000
 to what you've learned in this course.

0:04:19.460000 --> 0:04:23.620000
 So what, you know, what's the importance,
 what's the relevance of the

0:04:23.620000 --> 0:04:28.540000
 information or knowledge
 contained in this course?

0:04:28.540000 --> 0:04:33.560000
 And how, you know, can you apply it
 as a web app and test a well, you

0:04:33.560000 --> 0:04:37.200000
 know, firstly, securing APIs
 in real world environments.

0:04:37.200000 --> 0:04:41.600000
 You can now, you know, utilize your understanding
 of API or the fundamentals

0:04:41.600000 --> 0:04:46.040000
 of APIs to identify and address vulnerabilities
 in modern web services

0:04:46.040000 --> 0:04:51.240000
 and APIs. So the bottom line is you're
 now sort of comfortable with dealing

0:04:51.240000 --> 0:05:00.680000
 with APIs. And they're no longer this
 Pandora's box of functionality or

0:05:00.680000 --> 0:05:01.920000
 technical jargon.

0:05:01.920000 --> 0:05:06.500000
 You actually understand, you know, why
 they were created, you know, what

0:05:06.500000 --> 0:05:11.140000
 to essentially to solve what problem,
 what they look like in the wild,

0:05:11.140000 --> 0:05:15.220000
 and of course, how to interact
 with them and how to test them.

0:05:15.220000 --> 0:05:21.540000
 Secondly, you know, enhancing organizational
 security, you know, application

0:05:21.540000 --> 0:05:26.940000
 of the API security principles, learned
 in this course, you know, to strengthen,

0:05:26.940000 --> 0:05:32.680000
 can be used to strengthen the overall
 security posture of web applications

0:05:32.680000 --> 0:05:34.120000
 within your organization.

0:05:34.120000 --> 0:05:38.140000
 So if you work, you know, in an organization,
 if there's a developer or

0:05:38.140000 --> 0:05:41.420000
 someone, let's say on the defensive
 side, you're now able to take what

0:05:41.420000 --> 0:05:45.400000
 you've learned in terms of, you know,
 the actual attacks or vulnerabilities,

0:05:45.400000 --> 0:05:47.880000
 or an understanding of them.

0:05:47.880000 --> 0:05:52.700000
 And then of course, try and mitigate them,
 or, you know, improve the overall

0:05:52.700000 --> 0:05:55.580000
 security of your APIs within
 your organization.

0:05:55.580000 --> 0:06:00.700000
 And then of course, for the pen testers,
 this sort of ties in to your

0:06:00.700000 --> 0:06:05.040000
 overall repertoire or your skill set
 in that you're now able to conduct

0:06:05.040000 --> 0:06:08.700000
 even more thorough professional
 penetration tests.

0:06:08.700000 --> 0:06:11.640000
 So, you know, you can leverage the
 methodology learned in this course

0:06:11.640000 --> 0:06:16.220000
 to improve and obviously to conduct thorough
 and effective API penetration

0:06:16.220000 --> 0:06:20.940000
 tests. And, you know, identifying
 API weak points.

0:06:20.940000 --> 0:06:24.380000
 So you, you know, you'll also be able to,
 you know, perform detailed reconnaissance

0:06:24.380000 --> 0:06:26.820000
 to uncover exposed end points.

0:06:26.820000 --> 0:06:30.820000
 And of course, assess their risk, because
 that's arguably, you know, that

0:06:30.820000 --> 0:06:32.800000
 is important, I should say.

0:06:32.800000 --> 0:06:37.120000
 And then of course, hardening
 authentication systems.

0:06:37.120000 --> 0:06:41.060000
 So, you know, you'll be able to evaluate
 and improve API authentication

0:06:41.060000 --> 0:06:44.000000
 mechanisms to prevent
 unauthorized access.

0:06:44.000000 --> 0:06:49.820000
 So there's quite a lot of real world applications
 that, you know, essentially

0:06:49.820000 --> 0:06:52.560000
 stem from what you've been able
 to learn in this course.

0:06:52.560000 --> 0:06:54.020000
 And hopefully you see it that way.

0:06:54.020000 --> 0:06:58.420000
 Now I have a set of next steps that I
 recommend you take after completing

0:06:58.420000 --> 0:07:02.880000
 this course, they're essentially supposed
 to be recommendations on, you

0:07:02.880000 --> 0:07:07.220000
 know, other topics to learn that'll
 help you improve your skills, etc,

0:07:07.220000 --> 0:07:11.400000
 etc. So, I would really firstly, I would
 really recommend that you explore

0:07:11.400000 --> 0:07:13.100000
 advanced API security topics.

0:07:13.100000 --> 0:07:19.200000
 So, you know, dive into areas like OAuth
 2.0, OpenID Connect, stuff like

0:07:19.200000 --> 0:07:23.960000
 API rate limiting and secure
 API design principles.

0:07:23.960000 --> 0:07:28.340000
 You know, secondly, learn API automation
 or API testing automation.

0:07:28.340000 --> 0:07:33.680000
 So, master the use of tools like Postman,
 BERP Suite, and OSB has automated

0:07:33.680000 --> 0:07:36.520000
 API security testing.

0:07:36.520000 --> 0:07:39.860000
 I would also recommend you
 study cloud API security.

0:07:39.860000 --> 0:07:45.000000
 So, understand API security in cloud
 environments, focusing on AWS Azure

0:07:45.000000 --> 0:07:48.660000
 and Google Cloud APIs.

0:07:48.660000 --> 0:07:51.920000
 And with that being said, that brings
 us to the end of this course.

0:07:51.920000 --> 0:07:54.480000
 Hopefully you enjoyed it
 and found value in it.

0:07:54.480000 --> 0:07:57.460000
 I thank you very much
 for making this fall.

0:07:57.460000 --> 0:08:00.120000
 And hopefully I'll be seeing
 you in the next course.