NahamSec's New Video: API Security CTF by AppSec University

In this video, NahamSec delves into a Capture The Flag (CTF) challenge focused on API security, organized by AppSec University. The goal is to exploit various API vulnerabilities to achieve a final objective: redirecting a secret meeting to a location chosen by the hacker. This CTF serves as a real-world lesson on how hackers exploit API flaws. The CTF begins with registering and logging into the application via the API, obtaining an access token. The first task is to find the ID of a specific user.

NahamSec uses an API feature that unintentionally discloses sensitive information, a common practice in bug bounty programs. By exploring different API endpoints, he discovers one that lists user reviews, revealing the target user's ID. The second step is to find the group ID associated with this user. Using the user ID, NahamSec explores various result pages to locate the group ID. This step highlights the importance of enumeration and automation in searching for sensitive data. The next step is to find the activity ID associated with the secret meeting.

NahamSec uses the previously collected information to identify the correct activity ID. The task becomes more complex when it comes to forging a new token with a specific user role. After several unsuccessful attempts, NahamSec discovers an older version of the API that allows bypassing role restrictions. By deleting his own user account, he manages to obtain a token with a different role, gaining access to restricted features. The most difficult part of the CTF is finding a specific support ticket.

Using brute-force techniques and automation, NahamSec identifies a hidden endpoint that generates temporary tokens. These tokens allow access to sensitive information, such as chat messages and passwords. Finally, NahamSec needs to create a final request to redirect the secret meeting. Using all the collected information, he successfully forges the correct request and obtains the final flag of the CTF. This video demonstrates the importance of persistence, critical thinking, and the use of automation tools in API hacking. In conclusion, this CTF is a masterclass on how hackers exploit API vulnerabilities. It highlights the importance of securing APIs against attacks such as weak authentication, hidden endpoints, and privilege escalation. For those looking to deepen their API security skills, this CTF is an invaluable resource.