{"id":14308,"date":"2024-05-13T04:50:39","date_gmt":"2024-05-13T04:50:39","guid":{"rendered":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/"},"modified":"2024-08-01T05:25:45","modified_gmt":"2024-08-01T05:25:45","slug":"api-penetration-testing-bkk2024","status":"publish","type":"product","link":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/","title":{"rendered":"API Penetration Testing"},"content":{"rendered":"
\n
\n

ATTEND IN-PERSON<\/span><\/strong>: <\/span><\/strong>Onsite in Bangkok, Thailand<\/strong><\/h4>\n
\n
\n

DATE: 27-28 August 2024<\/strong><\/h4>\n<\/div>\n

TIME: 09:00 to 17:00 ICT\/GMT+7<\/strong><\/h4>\n\n\n\n\n\n
Date<\/strong><\/td>\nDay<\/strong><\/td>\nTime<\/strong><\/td>\nDuration<\/strong><\/td>\n<\/tr>\n
27 Aug<\/td>\nTuesday<\/td>\n0900-17:00 ICT\/GMT+7<\/td>\n8 Hours<\/td>\n<\/tr>\n
28 Aug<\/td>\nWednesday<\/td>\n0900-17:00 ICT\/GMT+7<\/td>\n8 Hours<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n
\n
This comprehensive two-day workshop goes deeply into the realm of API security. Participants will embark on a journey starting with a foundational understanding of APIs, throughout a discussion on various API architectures and protocols such as REST, SOAP, and GraphQL, with examples and focus on the different tools like Burp Suite, Swagger and SoapUI, which are a must to know for further dive into API security testing concepts.<\/h5>\n

Armed with this knowledge, attendees will continue their journey by learning key aspects of common API security testing methodologies & frameworks, such as the OWASP API Security Top 10 and the OWASP Web Security Testing Guide. The workshop includes multiple practical exercises and lab sessions covering a wide spectrum of topics including API reconnaissance, API authentication, API injection, and more, offering hands-on experience to reinforce theoretical understanding and foster practical skill development.<\/p>\n

\u00a0<\/strong><\/p>\n

\u00a0<\/strong>Key learning objectives<\/strong><\/h5>\n
    \n
  • Participants will acquire a thorough comprehension of API security principles.<\/li>\n
  • Attendees will gain practical proficiency in utilizing professional tools such as Burp Suite, Swagger, and SoapUI, essential for intercepting, analyzing, and securing API traffic, enhancing their capability to conduct effective security testing.<\/li>\n
  • Thanks to a set of guided instruction and practical exercises, participants will be leveraging security testing methodologies & frameworks such as the OWASP API Security Top 10 and the OWASP Web Security Testing Guide to assess the security of modern API implementations.<\/li>\n<\/ul>\n

     <\/p>\n

    What will the students get<\/strong><\/h5>\n
      \n
    • Battle-tested and future-proof API testing techniques.<\/li>\n
    • Fully configured Virtual Machine (VM) with a selection of pre-configured testing tools including proprietary fuzzing dictionaries ready to be used for delivering effective testing activities.<\/li>\n<\/ul>\n

      \u00a0<\/strong><\/p>\n

      \u00a0<\/strong><\/p>\n

      Agenda\/ Topics Covered<\/strong><\/h5>\n

      Overview on Application Programming Interfaces (APIs) Security<\/strong><\/p>\n

        \n
      • What is an API and why securing APIs is crucial for modern organizations.<\/li>\n
      • API architectural pattern security: REST, SOAP and GraphQL.<\/li>\n<\/ul>\n

         <\/p>\n

        Intercepting and Understanding the HTTP Protocol<\/strong><\/p>\n

          \n
        • What is HTTP and its different versions.<\/li>\n
        • Intercepting HTTP(s) protocol and API requests using Burp Suite Pro<\/li>\n
        • Tools of the trade for API security testing: Swagger, SoapUI, and beyond.<\/li>\n<\/ul>\n

           <\/p>\n

          API Security Testing Methodology<\/strong><\/p>\n

            \n
          • Overview on the OWASP Web Security Testing Guide (WSTG) v4.2<\/li>\n
          • The OWASP API Security Top 10 (2023)<\/li>\n<\/ul>\n

             <\/p>\n

            API Reconnaissance & Attack Surface Analysis<\/strong><\/p>\n

              \n
            • What is an Attack Surface?<\/li>\n
            • How to identify known & unknown API endpoints.<\/li>\n
            • How to identify known & unknown API parameters.<\/li>\n<\/ul>\n

               <\/p>\n

              API Authentication Security<\/strong><\/p>\n

                \n
              • Authentication Tokens\n
                  \n
                • JWT, SAML, OAuth and API key security<\/li>\n
                • XML encryption and signing<\/li>\n<\/ul>\n<\/li>\n
                • Authentication vs. Authorization\n
                    \n
                  • {Role\/Resource\/Fields} Level Access Control<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n

                     <\/p>\n

                    API Injection Vulnerabilities<\/strong><\/p>\n

                      \n
                    • SQL Injection<\/li>\n
                    • NoSQL Injection<\/li>\n
                    • Command Injection<\/li>\n<\/ul>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
                      This intensive 2-day workshop offers participants a thorough grasp of Application Programming Interface (API) security, highlighting the critical importance of comprehensively understanding and rigorously testing API implementations using cutting-edge techniques and state-of-the-art tools to effectively identify vulnerabilities.<\/h6>\n","protected":false},"featured_media":14307,"template":"","meta":{"_acf_changed":false},"product_cat":[85,84,86,87],"product_tag":[],"class_list":{"0":"post-14308","1":"product","2":"type-product","3":"status-publish","4":"has-post-thumbnail","6":"product_cat-2-day-workshop","7":"product_cat-bkk-2024","8":"product_cat-bkk-2024-workshop","9":"product_cat-workshop-2","11":"first","12":"outofstock","13":"shipping-taxable","14":"purchasable","15":"product-type-simple"},"acf":[],"yoast_head":"\nAPI Penetration Testing - HITBSecConf2024 - Bangkok<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"API Penetration Testing - HITBSecConf2024 - Bangkok\" \/>\n<meta property=\"og:description\" content=\"This intensive 2-day workshop offers participants a thorough grasp of Application Programming Interface (API) security, highlighting the critical importance of comprehensively understanding and rigorously testing API implementations using cutting-edge techniques and state-of-the-art tools to effectively identify vulnerabilities.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/\" \/>\n<meta property=\"og:site_name\" content=\"HITBSecConf2024 - Bangkok\" \/>\n<meta property=\"article:modified_time\" content=\"2024-08-01T05:25:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg\" \/>\n\t<meta property=\"og:image:width\" content=\"790\" \/>\n\t<meta property=\"og:image:height\" content=\"519\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/\",\"url\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/\",\"name\":\"API Penetration Testing - HITBSecConf2024 - Bangkok\",\"isPartOf\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg\",\"datePublished\":\"2024-05-13T04:50:39+00:00\",\"dateModified\":\"2024-08-01T05:25:45+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#primaryimage\",\"url\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg\",\"contentUrl\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg\",\"width\":790,\"height\":519},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Shop\",\"item\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/shop\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"API Penetration Testing\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website\",\"url\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/\",\"name\":\"HITBSecConf2024 - Bangkok\",\"description\":\"August 26 - 30 @ InterContinental\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"API Penetration Testing - HITBSecConf2024 - Bangkok","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/","og_locale":"en_US","og_type":"article","og_title":"API Penetration Testing - HITBSecConf2024 - Bangkok","og_description":"This intensive 2-day workshop offers participants a thorough grasp of Application Programming Interface (API) security, highlighting the critical importance of comprehensively understanding and rigorously testing API implementations using cutting-edge techniques and state-of-the-art tools to effectively identify vulnerabilities.","og_url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/","og_site_name":"HITBSecConf2024 - Bangkok","article_modified_time":"2024-08-01T05:25:45+00:00","og_image":[{"width":790,"height":519,"url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/","url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/","name":"API Penetration Testing - HITBSecConf2024 - Bangkok","isPartOf":{"@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website"},"primaryImageOfPage":{"@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#primaryimage"},"image":{"@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#primaryimage"},"thumbnailUrl":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg","datePublished":"2024-05-13T04:50:39+00:00","dateModified":"2024-08-01T05:25:45+00:00","breadcrumb":{"@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#primaryimage","url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg","contentUrl":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-content\/uploads\/sites\/22\/2024\/05\/matteo-bkk-workshop-3.jpeg","width":790,"height":519},{"@type":"BreadcrumbList","@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/product\/api-penetration-testing-bkk2024\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/"},{"@type":"ListItem","position":2,"name":"Shop","item":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/shop\/"},{"@type":"ListItem","position":3,"name":"API Penetration Testing"}]},{"@type":"WebSite","@id":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/#website","url":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/","name":"HITBSecConf2024 - Bangkok","description":"August 26 - 30 @ InterContinental","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/product\/14308"}],"collection":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/product"}],"about":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/types\/product"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/media\/14307"}],"wp:attachment":[{"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/media?parent=14308"}],"wp:term":[{"taxonomy":"product_cat","embeddable":true,"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/product_cat?post=14308"},{"taxonomy":"product_tag","embeddable":true,"href":"https:\/\/conference.hitb.org\/hitbsecconf2024bkk\/wp-json\/wp\/v2\/product_tag?post=14308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}