DEV Community

API

Application Programming Interface

Posts

👋 Sign in for the ability to sort posts by relevant, latest, or top.
HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs
roxdavirox profile
Davi

HMAC Proves Origin, Not Freshness: Replay Attacks Against Signed APIs

#api #authentication #cybersecurity #security
Comments
6 min read
Working: HTTP parameter pollution attacks APIs because WAFs evaluate one parameter value while frameworks execute a different one
roxdavirox profile
Davi

Working: HTTP parameter pollution attacks APIs because WAFs evaluate one parameter value while frameworks execute a different one

#api #backend #cybersecurity #security
Comments
5 min read
NoSQL Injection in APIs: From Auth Bypass to JavaScript Execution via MongoDB Operators
roxdavirox profile
Davi

NoSQL Injection in APIs: From Auth Bypass to JavaScript Execution via MongoDB Operators

#api #cybersecurity #database #security
Comments
5 min read
gRPC Server Reflection: The Unauthenticated API Catalog in Your Production Service
roxdavirox profile
Davi

gRPC Server Reflection: The Unauthenticated API Catalog in Your Production Service

#api #backend #cybersecurity #security
Comments
5 min read
API Versioning: When /api/v1/ Survives Without the Authentication Added in /api/v2/
roxdavirox profile
Davi

API Versioning: When /api/v1/ Survives Without the Authentication Added in /api/v2/

#api #backend #cybersecurity #security
Comments
5 min read
S3 Pre-Signed URLs Are Bearer Tokens: Five Attack Surfaces API Developers Miss
roxdavirox profile
Davi

S3 Pre-Signed URLs Are Bearer Tokens: Five Attack Surfaces API Developers Miss

#api #aws #cybersecurity #security
Comments
5 min read
Mass Assignment in REST APIs: When the Framework Binds More Than It Should
roxdavirox profile
Davi

Mass Assignment in REST APIs: When the Framework Binds More Than It Should

#api #backend #security
Comments
5 min read
CRLF Injection in API Responses: When User Input Reaches HTTP Headers
roxdavirox profile
Davi

CRLF Injection in API Responses: When User Input Reaches HTTP Headers

#api #backend #cybersecurity #security
Comments
5 min read
RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked
roxdavirox profile
Davi

RBAC Blocks the Wrong Layer: Mass Assignment Exploits the Fields Authorization Never Checked

#api #cybersecurity #infosec #security
Comments
6 min read
gRPC Security: The Authorization Model REST Scanners Cannot See
roxdavirox profile
Davi

gRPC Security: The Authorization Model REST Scanners Cannot See

#api #backend #cybersecurity #security
Comments
5 min read
Content-Type Confusion in REST APIs: One Header Switch, Three Attack Surfaces
roxdavirox profile
Davi

Content-Type Confusion in REST APIs: One Header Switch, Three Attack Surfaces

#api #cybersecurity #java #security
Comments
5 min read
API Tokens in CI/CD Pipelines: Five Exposure Surfaces That Rotation Does Not Close
roxdavirox profile
Davi

API Tokens in CI/CD Pipelines: Five Exposure Surfaces That Rotation Does Not Close

#api #cicd #devops #security
Comments
5 min read
REST API File Upload Attack Chains: MIME Bypass, Path Traversal, and SVG-to-XSS
roxdavirox profile
Davi

REST API File Upload Attack Chains: MIME Bypass, Path Traversal, and SVG-to-XSS

#api #backend #cybersecurity #security
Comments
6 min read
BFLA Survives Pentests: Why Testers Never Try the Wrong HTTP Method
roxdavirox profile
Davi

BFLA Survives Pentests: Why Testers Never Try the Wrong HTTP Method

#api #cybersecurity #security #testing
Comments
5 min read
LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope
roxdavirox profile
Davi

LDAP Injection in API Login Endpoints: Filter Corruption, CVEs, and the Active Directory Scope

#api #authentication #cybersecurity #security
Comments
5 min read
👋 Sign in for the ability to sort posts by relevant, latest, or top.