Tanya Janca and Nicole Becher -- Hacking APIs and Web Services with DevSlop
Om avsnittet
APIs may lack a visible interface, but that does not make them hidden or safe. Tanya Janca and Nicole Becher use OWASP DevSlop and its Pixi application to explain how developers and testers can learn API security hands-on. They cover HTTP fundamentals, authentication, rate limiting, proxies, curl, ZAP, and Burp Suite before showing how intentionally vulnerable applications turn those concepts into experiments. The conversation explores Pixi’s microservices, containerized design, planned capture-the-flag mode, and inspiration from OWASP Juice Shop and WebGoat. Tanya and Nicole also discuss the limits of automated scanners and the value of beginner-friendly CTFs. Their central recommendation is simple: interact with real APIs, observe the traffic, and practice breaking safe targets.
The Application Security Podcast is brought to you by Security Journey.
About Security Journey
Security Journey provides application security education for developers and everyone in the software development lifecycle.
→ Learn more about Security Journey
Connect with Tanya Janca and Nicole Becher:
→ Tanya Janca on LinkedIn
→ Nicole Becher on LinkedIn
→ OWASP DevSlop
Mentioned in this episode:
→ OWASP DevSlop
→ Pixi
→ OWASP ZAP
→ Burp Suite
→ OWASP Juice Shop
→ OWASP WebGoat
→ Docker
Follow the Application Security Podcast:
➜ Home
➜ X
➜ LinkedIn
➜ YouTube
➜ Instagram
➜ Facebook
Chapters:
00:00 Hacking APIs and web services with DevSlop
02:15 Nicole Becher’s security origin story
04:12 Learning AppSec through vulnerable applications
06:04 APIs, web services, and HTTP basics
08:27 Why an API is not invisible
10:42 Discovering API traffic with a proxy
12:30 Rate limiting and common API weaknesses
17:15 Using curl, ZAP, and Burp Suite
22:12 Pixi and the DevSlop application family
24:05 Containers and future modules
26:11 Building a capture-the-flag mode
28:15 Scanner limitations and better test targets
30:44 Why developers should try a CTF
32:47 Hands-on learning at AppSec USA
The Application Security Podcast med Chris Romeo and Robert Hurlbut finns tillgänglig på flera plattformar. Informationen på denna sida kommer från offentliga podd-flöden.