Dana Epp

Learn why shadow APIs sometimes provide a defenseless path for threat actors, and learn what YOU can do about it.

https://danaepp.com/why-shadow-apis-provide-a-defenseless-path-for-threat-actors

Looks like I’m a finalist for “API Security Person of the Year”. Like my articles and research? I’d appreciate your vote.

https://www.linkedin.com/posts/coreyjball_the-api-security-person-of-the-year-finalists-activity-7276021618643030016-5sqI?utm_source=share&utm_medium=member_ios

Let me show you how to weaponize API discovery metadata to improve your recon of the APIs you are hacking or conducting security testing on.

#apihacking #apisecurity

https://danaepp.com/weaponizing-api-discovery-metadata

Let me show you how to use JSON injection to manipulate API payloads to control the flow of data and business logic within an API.

#apihacking #apisecurity

https://danaepp.com/attacking-apis-using-json-injection

Learn how to improve your API discovery with a custom Burp Suite extension dedicated to automatically finding API document artifacts for you.

https://danaepp.com/hacking-api-discovery-with-a-custom-burp-extension

Let me show you why the X-Bug-Bounty custom HTTP header can be helpful during your bug bounty engagements with a target.

https://danaepp.com/why-the-x-bug-bounty-header-matters-for-hackers

Check out how to use upstream residential and mobile proxies in Burp Suite to evade IP blocking during your API security testing.

#apihacking #apisecurity

https://danaepp.com/evade-ip-blocking-by-using-residential-proxies

Let me show you how to cross-reference Known Exploit Vulnerabilities (KEV) against CWE to find the best attack vectors to use during security testing.

https://danaepp.com/kev-cwe-attack-vector

Learn how to write exploits that take advantage of blind command injection vulnerabilities using a time-delayed boolean oracle attack.

https://danaepp.com/from-exploit-to-extraction-data-exfil-in-blind-rce-attacks

Check out these five tips to help improve the API exploits you submit into security triage as part of your vulnerability research.

https://danaepp.com/5-tips-to-improve-your-api-exploits

Let me show you how to set up your hacking environment to attack mobile apps & APIs running on modern versions of Android with Burp Suite.

https://danaepp.com/hacking-modern-android-apps-with-burpsuite

Let me show you how to fuzz JSON to find security vulnerabilities in the APIs you are hacking with the help of a custom wordlist and Param Miner.

#apihacking #apisecurity

https://danaepp.com/fuzzing-json-to-find-api-security-flaws

Let me show you how to use Param Miner to find hidden parameters that may help manipulate an API in unintended ways, revealing potential security flaws.

#apihacking #apisecurity

https://danaepp.com/finding-hidden-api-parameters

Let me show you how to stay professionally detached from the vulnerabilities you discover and disclose as part of your security research.

https://danaepp.com/staying-professionally-detached-from-your-security-research

Let's explore the latest book by Packt Publishing on "Pentesting APIs" and see if it's worth putting on an API hacker's bookshelf.

#apihacking #apisecurity

https://danaepp.com/is-the-latest-book-on-pentesting-apis-any-good

Let me show you how to use MITRE's Common Weakness Enumerations (CWE) entries to level up your vulnerability reports.

https://danaepp.com/level-up-your-vulnerability-reports-with-cwe

Let me show you how to gain a competitive edge over other security researchers by detecting changes to APIs before others even know about them by using oasdiff.

#apihacking #apisecurity

https://danaepp.com/detecting-new-api-endpoints-with-oasdiff

Let's look at Tracfone's $16 million settlement with the FCC to understand why API security testing matters.

#apisecurity #apihacking

https://danaepp.com/why-api-security-testing-matters-learning-from-tracfone

Let me show you how to map MITRE CAPEC attack patterns to STRIDE threat model categories and improve your approach to security testing.

https://danaepp.com/mapping-attack-patterns-to-your-threat-model

Let me show you how to conduct covert data exfiltration within JSON payloads of an API response.

#apihacking #apisecurity

https://danaepp.com/covert-data-exfiltration-via-json-in-an-api