API clients' requests cost, at least bandwidth, computation cycles, memory, and storage, not only from the API back-end server but, in most cases several other systems, such as database servers. API requests compete for these resources to be fulfilled as quickly as possible but, improper resources m...
Either looking forward to generic implementations or due to short time-to-market, developers tend to expose all object properties (e.g. JSON), relying on clients (e.g. web front-end or mobile application) to filter relevant data to render. Quite often such data exposes system internals or personally...
In case you're not aware of our OWASP API Security Top 10 series, you can find the articles here. Most APIs, special those that support web front-ends or mobile applications, include several authentication-related endpoints. Based on our experience, quite often APIs fail to tackle brute force atta...
In case you're landing here coming from a search engine or a referral article, you may want to read our OWASP API Security Top 10 series debut article first. This is the first article in this series because it was, and probably still is, the most critical API security risk at the time the document...
This is not the first time we write about the OWASP API Security TOP 10 and it won’t be the last. On our “Hunting the OWASP API Security Top 10” article, we did a quick introduction to this OWASP project, explaining a bit our involvement and contributions to it. Because we find more and more vulne...
On June 15th, 2021 our COO David Sopas presented at C- DAYS 2021 “Taking Over Your Subdomain 101”, which you can watch on YouTube. In his talk, David explains with great detail what subdomain takeover is, how to exploit and prevent it, as well as several recent Char49 findings. In this article...
