‫Instructor: Hi.
‫Within this section we are gonna focus on API security.
‫So we're gonna see what kind of vulnerabilities
‫that we can find with inside of APIs
‫and also how to exploit them,
‫and also how to secure them as well.
‫So you can gain bug bounties out of those vulnerabilities
‫and also protect your own APIs as well.
‫So we're gonna use a real life example for that by the way
‫it's called vAPI or V API, Vulnerability Vulnerable API.
‫I'm gonna tell you all about it
‫and I'm gonna show you how to set it up,
‫don't worry about it.
‫But right now before we start
‫you have to know what an API is.
‫So API stands for Application Programming Interface.
‫It's kind of a programmer, it's kind of a software.
‫When we do a request, when we send some parameters
‫or send some request to it, we get a response back
‫and we can use it inside of both the web applications
‫or websites, and also mobile applications as well.
‫So, when we have a vulnerability inside of our API
‫it actually affects the web website
‫or the web application, mobile application.
‫It affects everything.
‫So it's a very crucial step
‫or it's a very crucial thing to secure the APIs
‫and that's what we are going to focus on
‫during this section.
‫In order to let you imagine
‫or in order to let you show what an API is,
‫I'm going to demonstrate a few examples.
‫But just so you know
‫that this section will be available both
‫on web application Pentesting course of mine,
‫and also mobile Pentesting course as well
‫because it actually affects both of them.
‫So let me talk about this
‫V API or vulnerable API, or vAPI thingy.
‫So this is a GitHub repository as you can see
‫and somebody named roottusk created this vAPI or V API
‫in order for us to understand the vulnerabilities inside
‫of the API and practice them.
‫So we are thankful to roottusk.
‫So this is an open source project
‫and we are going to actually install this on a real server
‫and we are going to do a real web pen testing
‫or real API pen testing in a real life example.
‫Yeah, so I found out this root task guy
‫has created this very magnificent API CTF
‫that I tried to solve it
‫and I just decided to show it to you guys
‫so that you can understand it in a better way.
‫So let me show you what a JSON format is.
‫So if you are a developer, you probably know this, okay?
‫You don't have to to open Google or something like that.
‫I'm just showing you this.
‫So this JSON format thing is some kind of format
‫that we get the information back from the API.
‫It doesn't have to be necessarily JSON,
‫it can be XML and stuff like that, but it generally is.
‫So maybe you should know what a JSON is.
‫It's just JavaScript object notation.
‫So it's kind of a notation, it's kind of a syntax.
‫And as you can see, this is an example JSON
‫where we see the ID name, picture, and stuff like that.
‫So when we send a request to the API
‫that we are going to be installing on our server,
‫we will get a response like this
‫when we do a request to that server.
‫So maybe we can do a request to get back to users
‫maybe we can just do a request to get back
‫to products of an e-commerce website.
‫It doesn't matter.
‫And I believe you are going to understand perfectly
‫why we are doing this section once we get to started.
‫But before we started,
‫I believe I should show you some real API example
‫from a real world example so that you can understand it
‫in a much better way because they are very critical, okay?
‫They're very critical so before we install the vAPI,
‫I'm going to show you something from udemy.com
‫and you can actually see this from any website
‫but I'm just going to show it to you from udemi.com.
‫And in order to do that, I just opened the udemi.com
‫and I can see my own courses over here,
‫recommended to me for some reason.
‫And I'm going to open the Burp Suite,
‫if you don't know what a Burp Suite is,
‫don't worry you're gonna learn it in a couple of lectures.
‫But if you got the web pen testing course,
‫of course you know it.
‫So intercept is on Burp Suite,
‫is a tool that we can capture the packets
‫that we are sending them.
‫So what I'm going to do,
‫I'm going to click on one of the courses on Udemy,
‫and before it sends the message
‫or sends the request to the server
‫I'm gonna capture that inside of the Burp Suite
‫so that we can actually see what are we sending
‫to the server, or what is the endpoint,
‫what are the parameters and stuff.
‫So let me show you what I mean.
‫I'm going to click one of those courses and here you go.
‫It didn't capture the packet because I couldn't change,
‫I forgot to change the proxy.
‫Right now, I changed the proxy.
‫If you don't know how to change the proxy,
‫don't worry about it.
‫I'm gonna show you later on within this section.
‫And once I change the proxy cost,
‫the parameters it cost the packet over here,
‫as you can see it is doing a get request to this website.
‫It's not an API right now it's courses slash
‫the complete mobile ethical hacking course.
‫So this is the address of my course in Udemy.
‫Okay, that is cool, but that is not what I'm looking for.
‫So this is not an API, this is just a regular website.
‫If you just copy and paste it,
‫and just paste it in your browser and go to it,
‫you will see what I mean.
‫What I'm going to do,
‫I'm gonna disable the proxy one more time
‫and go back to udemy.com and refresh it.
‫Right now without going into the course itself.
‫I'm just going to turn it on,
‫and turn the proxy on the Burp Suite on as well.
‫I'm going to click it on one more time.
‫So once I click it,
‫it will capture the packet and here you go.
‫Right now it's doing a post request to this API
‫and if you look at the URL, it's actually API dash two.
‫So this is version two visits and something like that.
‫It's doing a funnel page API call.
‫What does it mean?
‫Because once I clicked on the course,
‫it took me to a site
‫and once I captured the packet over there,
‫it actually showed me a URL.
‫But right now, without going into the URL,
‫once I click on the one of the icons on the main page,
‫it actually does an API call
‫because it's actually sending some parameters
‫to that funnel log state or funnel log
‫API funnel log endpoint.
‫And getting back some information most probably about me,
‫so that it can understand
‫what kind of cookie that I'm using.
‫Did I purchase a course before from Udemy?
‫So should it show some kind
‫of low pricing or high pricing to me?
‫Okay, so this is an API of Udemy.
‫And as you might imagine
‫Udemy uses this inside of its website,
‫web application, and also mobile application as well.
‫Okay, that was a real API,
‫but right now I believe we have to focus
‫on this roottask vAPI, or V API, or vulnerable API.
‫So let's see the root task, it's Tushar Kulkarni,
‫thank you very much Tushar for sharing this with us.
‫I'm going to show you how to install this on a real server,
‫but before that I need to show you something else,
‫I need to show you OWASP Top 10.
‫So if you got the web pen testing course from
‫you already know what an OWAS Top 10 is,
‫it's the most vulnerability, or most common vulnerabilities
‫that come across in the web world
‫but this time I'm going to show you
‫OWASP Top 10 API version.
‫Okay? So as you can see, if you Google for us OWASP Top 10,
‫you will see it and we have actually seen
‫every one of those inside of web pen testing course.
‫But also there is an top 10 for APIs as well.
‫It turns out that it's critical for us
‫and it's critical for OWASP as well.
‫They gather information, they gather data
‫for the most common vulnerabilities in the APIs as well.
‫So what happens is that the V API
‫that we are going to be solving
‫actually got this data from this list.
‫So let me show you what I mean.
‫I'm going to search for OWASP Top 10 API
‫and we will see something like very similar to this.
‫Maybe you have seen this before.
‫This is Top 10 Web Application Security Risk.
‫Okay, like injection, or the broken access and stuff.
‫So you know all of the stuff or maybe you have heard before.
‫But if we go to Google and search for OWASP Top 10,
‫but OWASP API Top 10, like this, okay?
‫Then, we can see the actually API security list as well,
‫the actual security list as well.
‫So I'm going to open this in a new tab and here you go.
‫So, it actually starts
‫with telling us what is an API security.
‫The time that I record this, it's saying that top 10 2019,
‫it's not actually updated every year, okay?
‫I'm recording this like something early 2022 but,
‫it hasn't been updated yet.
‫But as you can see,
‫we have a lot of misconfigurations in proper management,
‫logging, monitoring, and everything.
‫Over here, we have a lot of vulnerabilities.
‫And I can assure you once it gets updated,
‫okay, maybe next year, many of them won't even change.
‫Okay, so maybe a couple of new ones will come to the list
‫but the idea will still be the same.
‫So this vulnerable API actually gets this data, okay?
‫The roottask actually looked at that list
‫and prepared the challenge, prepared the CTF
‫in a way that we can understand everything on that list.
‫So it's a great opportunity for us to solve this
‫in order to understand the API security.
‫But it happens that if we install this on a real server,
‫that will be much more realistic
‫and it would work in a much better way.
‫So what I did, I forked this, okay?
‫I put it on my own GitHub, as you can see,
‫you can reach it via github.com 'til someone slash API.
‫Post the video if you like
‫and just copy and paste the stuff, and go into there.
‫I taught this by the way
‫because I don't want you to get factored
‫by the future updates.
‫So, if you come over here and clone this,
‫or you can just download the .zip in a way that you want
‫just download the .zip on your own machine, okay?
‫We are not even going to use that
‫for installing out the server,
‫but we are going to need some resources on that folder.
‫That's why I'm telling you this.
‫Just go to this website, github.com
‫until someone will use slash API, and download this.
‫Don't worry about the server configurations and stuff,
‫I'm gonna show you in the upcoming lectures.
‫But right now, all you gotta do is just download this folder
‫and be ready for the next one.