Inon Shkedy

🧘‍♂️🌱

Head of Research @Traceableai | API Security Project Leader @OWASP

Falo 🇧🇷/🇦🇷/🇺🇸/🇮🇱/🇹🇭

[Inon Shkedy @InonShkedy]

https://t.co/aGaQShVTJy

A Deep Dive On The Most Critical API Vulnerability - Broken Object Level Authorization

[Inon Shkedy @InonShkedy]

@hasolidit אני באופן אישי מוצא קורלציה ישירה בין אנשים שקוראים הרבה ספרי self help ואנשים שלא הייתי רוצה לחיות כמוהם.

מרגיש שהמרדף אחרי עוד ידע ועוד כלים ״לחיות את החיים נכון״ בסופו של יום פשוט מאמלל אותך

[Inon Shkedy @InonShkedy]

@OrBergman @yantomr4 יותר ויותר
אנשים מדברים את האמת בטוייטר

[Inon Shkedy @InonShkedy]

@hasolidit @yantomr4 סוף סוף מישהו שמעריך שירה

[Eaton Z. @XeEaton]

💥 2 TB internal drive mod for Bad Update users coming soon! 💥

[Eaton Z. @XeEaton]

📢 Today is the day! After about a year reverse engineering 4 different SSD controller brands, Xbox 360 HDD Maker is now available. For the first time, it is now possible to add an SSD to an unmodified, retail Xbox 360 console.

[Inon Shkedy @InonShkedy]

@tomergor @yantomr4 מזמין לנו שולחן לביקור שלי בארץ?

[Inon Shkedy @InonShkedy]

One of my favorite disclosed API breaches, discovered by my colleague @XeEaton

I highly recommend reading it on your laptop to see how your cursor turns into a French fries container.

https://t.co/9eSni5v4U8

[bugoverflow @bugoverfl0w]

I noted this post https://t.co/zCObcJllYP for easily reading in my understanding.

31 API Tips by @InonShkedy

#bugbountytips

[Inon Shkedy @InonShkedy]

@yantomr4 מסנן אותי אבל מצייץ בטוייטר אה קלב

[Inon Shkedy @InonShkedy]

@amsterdamski2 AirFly - מאפשר להשתמש באיירפודס/כל אוזניות אל-חוטיות במערכת מולטימדיה של המטוס

[Inon Shkedy @InonShkedy]

Join me in person @ Cincinnati/online! We'll talk about:
🔑Complex multi-step authorization breaches.
🤖Bots: how bad actors exploit the API economy for profit.
🔍Modern vs. Traditional: the shift away from traditional issues like injections, XSS, and XXE.
https://t.co/n6pvX5nxC1

[Inon Shkedy @InonShkedy]

@yantomr4 סוף סוף נראה כמו בנאדם ולא כמו סמרטוט

[Inon Shkedy @InonShkedy]

@yantomr4 שמור על עצמך קלב
מישהו צריך להכין לי פו טבעוני

[Inon Shkedy @InonShkedy]

@yantomr4 @DorDugy לא יכולתי לכתוב את זה בצורה מדוייקת יותר

[Inon Shkedy @InonShkedy]

@Alder_Birch_ As long as the EP actually returns data about the accessed object - It's pretty safe to use this method

[Inon Shkedy @InonShkedy]

-API Tip 28/30- #bugbountytip

Save time by comparing response sizes instead of response bodies.
E.g,
- Generate 2 API calls to test for IDOR/BOLA, use 2 different IDs
- 2 API responses have the same size? EP is probably not vulnerable

[Inon Shkedy @InonShkedy]

@Alder_Birch_ Two main exceptions I can think of:
1. EP doesn't return data about the accessed object. For example: DELETE /photo/22 might return just 200 with a JSON : {"status":"ok"}
2. If two different returned objects are exactly the same size. For example:

[Inon Shkedy @InonShkedy]

@Alder_Birch_ {"name":"inonsh":"age"28}
{"name":"boreal":"age"21}
// this one is less likely because usually JSON objects contain multiple params, and the likelihood of 2 objects to be the exact same size is low in most cases

[Inon Shkedy @InonShkedy]

@BolhaSec crossfit me faz mais estressado haha

[Inon Shkedy @InonShkedy]

@Secnik1 haha hack with your mind

[Inon Shkedy @InonShkedy]

-API Tip 30/30- #BugBounty

Feeling stuck but have to find a critical vulnerability?
1. Wake up early in the morning.
2. Meditate, do some exercise.
3. Turn off your phone, disconnect from the world for several hours, drink a coffee.
4. Dedicate yourself to the process :)