@ddǝɐuɐp

I help builders and breakers of code learn to find security vulnerabilities in their apps and APIs.

[@ddǝɐuɐp @DanaEpp]

Wanna learn API hacking?

Check out my API Hacker Inner Circle newsletter. It's free. And covers lots of great API hacking insights.

https://t.co/t88rrMAYGT

[@ddǝɐuɐp @DanaEpp]

You know @BCFerries , why not notify your customers with reservations (by email and the app) when you cancel your sailings??? Nothing like driving for hours only to find out you cancelled all reservations when we arrived at the terminal. According to @CBC, you knew at 10am.

[@ddǝɐuɐp @DanaEpp]

This Prompt Injection Taxonomy from @Jhaddix is sweet. Awesome job man!

https://t.co/v81ipgxvAe

[@ddǝɐuɐp @DanaEpp]

Ya @Apple really has a bad partner with @Rogers. I pre-ordered on the 12th and was told I’d have it 2 business days after the 19th on Vancouver Island. Got the email today telling me now it’s 4 weeks back ordered. But at the Apple Store in Vancouver I can pick it up on the 19th still. Totally frustrating.

[Intigriti @intigriti]

1️⃣ API Security Testing using AI in Postman

@danaepp shows how you can perform API security testing by weaponizing Postman's AI assistant (Postbot) to automatically generate sophisticated security tests.

https://t.co/OgyAYwLpcZ

[Intigriti @intigriti]

12 API hacking bug bounty tips you must try on your target! 😎

🧵 👇

[Web Security Academy @WebSecAcademy]

Learning Path: API testing

In this learning path, you'll learn:
🔸 How to find undocumented or unused API endpoints
🔸 Techniques to discover hidden parameters
🔸 How to test for mass assignment and SSPP
🔸 Methods to prevent vulnerabilities in APIs

Start the API Testing Learning Path now: https://t.co/upWLHQQI64

[@ddǝɐuɐp @DanaEpp]

That is trippy. And works better than expected.

[@ddǝɐuɐp @DanaEpp]

That feeling you get when working with a software vendor whose latest earnings report shows massive profitability... and yet they still won't fund their bug bounty program properly...

#bugbounty

[@ddǝɐuɐp @DanaEpp]

Learn how to look at your API testing through a security lens to get the best code coverage and approach it with offensive security in mind.

https://t.co/0xiXgzUMuW

[@ddǝɐuɐp @DanaEpp]

Let me show you how to exploit embedded system APIs by dumping firmware to get access to API artifacts, including configs and source code.

#apihacking #hardwarehacking #CH341A

https://t.co/EPP8gwHBzE

[@ddǝɐuɐp @DanaEpp]

To all the hackers out there...

Beat down the demon of self-doubt and embrace imposter syndrome as a healthy signal for motivation and drive.

https://t.co/QdHslkAexe

[@ddǝɐuɐp @DanaEpp]

I've got a Flipper Zero.

Let's have some fun with it and try to hack the API on a Wifi Pineapple embedded device.

#flipperzero #apihacking

https://t.co/671P6mYNKQ

[@ddǝɐuɐp @DanaEpp]

Righteous doesn't mean illegal.

But man... getting one of those Gibsons....

[@ddǝɐuɐp @DanaEpp]

If you like this tweet, you will love the API Hacker Inner Circle newsletter.

Join 10k+ appsec hackers: https://t.co/t88rrMAYGT

[@ddǝɐuɐp @DanaEpp]

Read this to understand why you should never blindly trust proof of concept (PoC) exploits shared on GitHub.

https://t.co/AOWXUVFisz

[@ddǝɐuɐp @DanaEpp]

Always be learning.

Improve. Adapt. Overcome.

Never doubt yourself. You've got this. Maybe just not today.

Failure is nothing more than learning a new way NOT to do something in the future.

Experience makes you better.