API Marketplace
TeejLab APIs
Learning Hub
Learning and Exploring API Basics
API Discovery is the process of identifying and cataloging APIs in a network or system. This is crucial for developers because it helps them understand what APIs are available, how they function, and how they can be integrated into their projects. API Discovery tools automatically detect APIs and provide details about their operations, making it easier to manage and utilize them in software development. This process supports better governance, security, and utilization of APIs within digital environments.
API Discovery, especially for a security engineer, also involves identifying and mapping out APIs within a system to ensure comprehensive security coverage. This process includes detecting both documented and undocumented (sometimes referred to as "shadow" or "hidden") APIs to assess their security posture, manage access controls, and ensure compliance with security policies. Effective API Discovery helps mitigate risks associated with API vulnerabilities, unauthorized access, and data breaches, making it a critical component of a robust application security programs.
API Discovery and Digital Transformations
TeejLab API Discovery platform is built for people with technical as well as non-technical skills to explore various aspects of APIs to accelerate the development of innovative applications.In this process, API Discovery plays an important role from security and governance perspectives.
TeejLab's advanced API Discovery mechanisms leverage upon AI to enhance discovery processes, predict usage patterns, and recommend governance frameworks. The goal is to fully integrate APIs into enterprise architectures, optimize their interoperability, and maintain regulatory compliance, enhancing operational efficiency and innovation potential.
Signing for the API Discovery Platform
Account Customization in API Discovery Platform
1. Amishi logs into their TeejLab account and navigates to the profile section by hovering over their name in the top right corner and clicking "profile."
2. Users can view and edit details such as their profile picture, username, first and last name, and email by clicking the "edit" button, making the desired changes, and pressing "save."
3. Changing the account password follows a similar process: click "edit," scroll to "set password," enter and confirm a new password, and save the changes.
4. Other account information accessible from the profile page includes the personal TeejLab key, viewing history, and payment activity.
5. For platform appearance settings, users should hover over their name in the top right corner and select "settings."
6. In the settings section, options are available to change the time zone, menus displayed on the homepage, and the homepage image.
7. To update the homepage image, select a new image and press "save."
Developing Applications using APIs from API Marketplace
Key points include:
1. Centralized Access: TeejLab provides a centralized platform where you can access a wide range of APIs using a single endpoint.
2. Unified API Key: Users only need one API key from Teob to access all available APIs, eliminating the need to manage multiple keys from different vendors.
3. Simplified Documentation: TeejLab consolidates the documentation, making it easier to understand how to use different APIs without navigating through various vendors’ sites.
4. Code Adaptability: The presenter shows how to adapt the same piece of code to call different APIs by simply changing the endpoint ID and the required parameters.
5. Efficiency and Time Saving: Using TeejLab saves significant time and effort as developers do not need to create multiple accounts or understand different integration methods for each API.
Overall, the video highlights the advantages of using the TeejLab platform for API integration, emphasizing its efficiency, simplicity, and user-friendly approach for developers working on various projects.
Exploring AI-Driven APIs
1. Introduction: The video references the previous video where the ChatGPT API was added to the TeejLab platform and tested on the website.
2. Usage in Popular Applications:
-Snapchat: Snapchat uses the ChatGPT API for their My AI chatbot, allowing users to text an AI chatbot that generates human-like responses, enhancing user experience.
-Quizlet: Quizlet uses the API for their AI tutor, which quizzes users and creates an engaging learning experience.
-Shop: The Shop app uses the API as a shopping assistant to answer user questions and provide personalized recommendations.
-Instacart: Instacart uses the API to allow users to ask food-related questions, enhancing the shopping experience.
3. Demo on Quizlet: The video demonstrates the API in action on Quizlet, showing how the AI tutor generates responses based on user prompts.
4. Versatility of APIs on TeejLab: The video highlights that the TeejLab platform offers hundreds of APIs from various categories, such as weather forecasting, financial information, and social media integration. These APIs can be quickly tested and accessed on the platform.
5. Developer Convenience: TeejLab is praised for making developers' lives easier and more efficient by providing all necessary tools and information in one place.
6. Next Steps: The video concludes by mentioning that the next video will show how to use these APIs in personal projects.
Using ChatGPT API for Developing a Chatbot
Key points include:
1. API Key Setup: Initially, you generate or copy your existing API key from your TeejLab platform profile.
2. Proxy Creation: You create a proxy for the API on TeejLab, which uses this API key, allowing all API interactions to route through TeejLab.
3. Programming Integration: The video demonstrates how to integrate the API into a Python project using the requests module. The process involves making a POST request with the API endpoint, the required parameters, and headers including the API key.
4. Code Simplification: Amishi refactors the code for clarity, creating variables for each component of the request to make the code cleaner and easier to understand.
5. Practical Example: A simple chatbot is created to demonstrate the API in action. This bot uses a loop to accept user input, makes requests to the API, and prints the chatbot responses.
6. Platform Benefits: TeejLab unified approach saves time and reduces the complexity typically associated with managing different APIs from multiple vendors. It allows for easy testing, management, and integration of various APIs into projects.
Visual Studio Code Plugin - TeejLab API Discovery
1. Introduction: The video explains that the API Discovery extension allows users to scan source code and identify endpoints within source code files.
2. Opening Visual Studio Code: The video demonstrates opening a new window in Visual Studio Code. The user interface may vary depending on the operating system.
3. Navigating to the Extension Marketplace: Users are instructed to go to the left side panel and click on the puzzle piece icon to access the Visual Studio extension Marketplace.
4. Finding the API Discovery Extension: By typing "API Discovery" in the search bar, users can find the API Discovery scanner extension. The video describes the extension’s features and requirements, such as a user account for API Discovery and a Java runtime environment.
5. Installing the Extension: The video shows how to install the extension by clicking the "Install" button. The installation may load from cache or download required files.
6. Opening the API Discovery Window: Users can open the API Discovery window by navigating to "View" and then "Command Palette" or by using the shortcut Ctrl+Shift+P. Another method is right-clicking on a folder to scan and selecting "API Discovery Scan."
7. Scanning Source Code: The video demonstrates opening a folder containing source code files (e.g., Kotlin and Java files) and scanning for endpoints using the API Discovery extension.
8. Logging In: Users log in to the API Discovery extension with their credentials to start scanning projects.
9. Filling in Project Details: The video shows filling in project name, vendor, and version fields, and selecting whether to scan repositories or local projects.
10. Scanning a Repository: The video demonstrates scanning a GitHub repository by copying the repository URL and starting the scan in Visual Studio Code.
11. Scanning Local Projects: The video shows scanning local projects by selecting a zip file or directly scanning folders within Visual Studio Code.
12. Viewing Scan Results: Once the scan is completed, a brief text of results will pop up, and the scan will be populated on the API Discovery platform.
13. Logging Out: Users can log out by clicking the log-out option in the top right corner.
Eclipse Plugin - TeejLab API Discovery
1. Introduction: The video introduces the process of installing and using the API Discovery scanning plugin for Eclipse.
2. Installing Eclipse: Users are instructed to install Eclipse if it is not already installed. The video demonstrates opening Eclipse to the default workspace or a test workspace.
3. Eclipse Workspace: The default Java perspective is shown, and users can open Java projects or folders from the file system.
4. Installing the Plugin: The video shows how to install the API Discovery plugin by navigating to "Help" and selecting "Install New Software." Users enter the direct URL for the API Discovery plugin and follow the prompts to install it. Ensure "Contact all update sites" is unchecked to speed up the download.
5. Restart Eclipse: After installation, users restart Eclipse to finalize the installation.
6. Opening the API Discovery Scanner: Users go to "Window," "Show View," "Other," and select "API Discovery Scanner" to open the new API Discovery window.
7. Signing In: Users sign in using their TeejLab API Discovery platform credentials.
8. Scan Project Settings: The video shows entering a project name, vendor, and version in the scan project settings window. Users can select files directly from the file system or from within Eclipse by right-clicking on a folder in the package explorer and selecting "API Discovery Scan."
9. Scanning a Folder: The video demonstrates scanning a folder named "OK HTTP Master" by filling in the project name and vendor fields. The scan is initiated by clicking "Start Scan."
10. Viewing Scan Results: Once the scan is complete, users can view the results on the API Discovery platform by logging in and navigating to "My Results" and "Scan Projects."
11. Scanning a Repository: Users can also scan a GitHub repository by entering the repository URL. The process is similar to scanning local files, and the results are uploaded to the API Discovery platform.
12. Logging Out: The video concludes by showing how to log out from the API Discovery plugin.
Scan Source Codes (File Uploads) for Discovering APIs
Key points include:
1. Navigation to Scan API: Start by going to 'my actions' and selecting 'scan API projects.'
2. Settings Configuration: Click on 'settings' to adjust the scan preferences. There is an option to scan all files by checking a specific checkbox. If unchecked, you can specify the types of files you want to scan, such as Java and C files.
3. API Discovery Option: There is a checkbox that, when enabled, allows the discovery of implemented APIs within the scanned application.
4. Visibility of Lines: You can set the number of lines visible before and after each endpoint match, with options ranging from five to fifteen lines. Terry selects ten lines for this demonstration.
5. Saving Settings: After configuring the settings, click 'save' to apply them.
6. Local Project Scan: To scan a local project, you need to choose a file, preferably a zip file. Terry suggests downloading a zip file from GitHub or zipping a local file.
7. Starting the Scan: Once the file is chosen and uploaded, start the scan. Wait for the scanning process to complete.
8. Viewing Results: After the scan completes, the project appears on the platform, and you can click on it for more details.
Scan Networks (VPCs/Workstations) for Discovering APIs
Key points include:
1. Agent Setup: The agent requires specific settings to analyze network traffic. Users can set a time window for the agent to run, ranging from a few minutes to the entire day, to capture API activity and generate a summary report.
2. Configuration Options: There are several settings available such as how frequently the agent reports back to the server and what ports to monitor, depending on which the application communicates.
3. Deployment: The network analysis agent can be deployed on any device expected to have API traffic, including gateways and personal computers. In this demo, the agent is run on a local laptop to monitor local API traffic.
4. Operation: The agent works passively, analyzing HTTP traffic without interfering with network performance. It captures data on API usage and identifies the APIs being used by applications running on the network.
5. Traffic Generation: To demonstrate, the presenter generates local API traffic by making API calls from their machine. This includes attempts to access APIs with and without authentication, illustrating how the agent detects even failed API calls.
6. Results Dashboard: Results of the network scan are displayed on a dashboard, showing details like the APIs called, the vendors, and the geographical location of the servers handling these API calls. This information helps in understanding data flow and storage, crucial for data governance and compliance.
7. Practical Use Case: The demo includes practical examples of API calls, including parameter requirements and handling calls that do not require authentication, showcasing how the agent can capture and analyze these interactions.
8. Conclusion: The session concludes with a review of the scan results and offers to address further questions through email or additional meetings.
This video highlights the capabilities of network analysis tools in identifying and managing API interactions within a network, providing valuable insights for IT security and network management.
Scanning Multiple GitHub Repositories
Scan Single Repo (GitHub Project) for Discovering APIs
Digitial Transformation in Finance, Banking and FinTech
Key points include:
1. Platform Navigation: Amishi begins by navigating to the finance and banking category on the TeejLab platform, highlighting the availability of multiple APIs.
2. API Selection: The chosen API for the demonstration is the cryptocurrency API by Coin Paprika, noted for its simplicity and effectiveness in tracking cryptocurrency data.
3. Endpoint Testing: Two specific endpoints are tested:
- Twitter Endpoint: This retrieves the Twitter timeline for a specific cryptocurrency coin, showing details like retweets, likes, and status links.
- Exchanges Endpoint: This provides a list of exchanges where the specified coin is traded.
4. Use Cases Discussion:
- Trading Bot: The API could be integral to developing a trading bot that requires real-time data on exchanges and public sentiment (gathered from Twitter) to make automated trading decisions.
- Strategy Backtesting: The API's historical data endpoint would be useful for traders wanting to test trading strategies against historical market data to assess effectiveness.
- Pricing Websites: Various endpoints would be useful for websites that track and display cryptocurrency prices and performance metrics.
5. Further Learning: The presenter encourages viewers to watch a previous video that explains how to integrate these APIs into their projects using the TeejLab platform.
This video is designed to help viewers understand how to leverage the TeejLab platform’s cryptocurrency APIs for applications related to trading, analysis, or monitoring of cryptocurrencies.
Open API Economy - Managing API Legal Agreements
Key Points:
API Economy Quantification: Baljeet illustrates how APIs are becoming as fundamental as websites by showing their growth trends and discussing the integration and automation they enable.
Global API Repositories: He mentions major repositories like Postman and RapidAPI that track APIs globally, noting the importance of these platforms in understanding the API landscape.
Legal Agreement Challenges: The presentation highlights the challenges in managing API legal agreements, especially in how frequently these agreements are updated and the complexities involved in ensuring compliance across different jurisdictions.
Use Cases: Baljeet offers use cases that demonstrate the practical implications of API legal agreement management, such as in creating trading bots, conducting strategy backtests, and developing pricing websites.
Risk Management: The talk goes into detail about how managing these agreements is crucial for risk management and governance in the API economy.
Demonstration: Baljeet provides a live demonstration of analyzing Facebook's terms of service to show how the terms have evolved over time and what that implies for API users and developers.
Discussion on Standardization: He addresses the difficulties in standardizing API legal terms due to their dynamic nature and the diverse strategies of different enterprises.
The session wraps up with a Q&A where Baljeet further explains the challenges of manual monitoring of API agreements and the necessity of AI-driven solutions to manage the scale and complexity of modern API ecosystems. He also discusses ongoing efforts to standardize API terms to make them clearer and more manageable.
Cyber Fraud Management through Digital Forensics
Web APIs are common glue that connect these digital ecosystems with people and processes all across the globe. APIs have the power to impact organizations both positively (through innovations, new business models, competitive differentiation) and negatively (due to security, business disruptions, legal and compliance issues). These impacts are compounding with increased API footprint of enterprises. Not surprisingly, Web APIs are contributing up to 85% of the Internet traffic enabling various digital operations. It is imperative for Fraud Examiners and Audit Professionals to better understand various digital frauds in the cyber-world that could occur through APIs posing various risks to organizations.
API Forensics has become an important aspect of technology due diligence, especially for detecting business frauds and crimes. In this session, we'll go through the details of an API-Forensics process containing hands-on-training scenarios to help Fraud Examiners, Auditors, Compliance and Cybersecurity practitioners. We’ll also highlight industry best practices thorough hands-on examples for API Risk Management.
Dynamic Malware Analysis with API Logging and Monitoring
1. Introduction: The presenter introduces the topic of dynamic malware analysis, continuing from a previous session where Process Monitor was used. This session will focus on API Logger and API Monitor to analyze malware by tracing API calls.
2. Overview of Tools: The presenter describes the two tools to be discussed:
- API Logger: Used for injecting into processes and logging API calls.
- API Monitor: Provides a more detailed and interactive interface for monitoring API calls, with capabilities to filter and view detailed parameters and results of API calls.
3. Demonstration of API Logger:
- Setting up the tool by selecting malware samples to analyze.
- Injecting the API Logger into the malware process and observing the API calls made, such as file creation, registry modifications, and network communications.
- Discussion of how specific API calls like "CreateFile", "RegistrySetValue", and internet-related APIs like "InternetConnect" and "HTTP requests" reveal the malware's actions.
4. Analysis Using API Monitor:
- Differentiating between the 64-bit and 32-bit versions of API Monitor based on the application being analyzed.
- Configuring the tool to monitor a new malware process, detailing the process of setting up monitoring parameters.
- Real-time monitoring of API calls, with explanations of how to search for specific API actions related to file handling and network communication.
5. Practical Insights:
- Explaining the significance of monitoring API calls to understand malware operations such as file access, registry interaction, and network behavior.
- Highlighting how API calls can indicate malicious activities, including evasion techniques like checking for debugging tools.
API Discovery, Security and Governance
1. Discover hidden/shadow APIs via industry leading Static and Dynamic Analysis.
2. Empower developers with automated Source Code Scan and API Benchmark tools to build applications faster without compromising on security and legal risks.
3. Govern private, public, free, and paid APIs through internal and external marketplaces.
4. Enable InfoSec teams with automated Network Scanning tools to detect and prevent unauthorized access to digital resources facilitated by myriad of APIs.
5. Empower leadership teams with powerful analytics having compliance and business insights to make informed decisions during vendor/partner selections and M&A transactions.
API Governance: What is it and why does it matter?
1. Introduction to API Governance:
- The necessity of API governance for organizations to manage the increasing number of APIs.
- Benefits of a unified approach to API design, discoverability, and usage.
2. Importance of APIs:
- APIs as essential tools for delivering value to consumers.
- Analogy of APIs to beer cans or bottles that deliver the contents efficiently.
3. APIs in Action:
- Example of a weather forecasting service delivered through an API.
- The scalability of APIs allows for handling increased consumer numbers and diverse consumer mechanisms seamlessly.
4. Challenges in API Consumption:
- The evolution of API usage as it becomes more popular, necessitating updates and enhancements without disrupting existing services.
5. API Product Lifecycle Management:
- Importance of iterative improvement to increase API consumption and value over time.
- The concept that the value of an API is realized through its consumption across various releases.
6. Challenges for API Products:
- The need to treat APIs as products to ensure they are well-documented, discoverable, and user-friendly.
- Rapid enhancement capabilities to meet consumer demands without breaking existing functionalities.
7. Scaling API Experiences:
- Discussion on managing not just a single API but a landscape of APIs.
- The necessity for API governance to facilitate seamless integration and interaction among multiple APIs.
8. Enhancing User and Developer Experiences:
- Importance of designing API landscapes that are intuitive and valuable to both end-users and developers.
- Addressing the challenges of API landscapes, such as ensuring coherence and stability to encourage innovation without excessive restrictions.
9. Implementing Effective API Governance:
- Strategies for cultivating a productive API landscape, including observing APIs for insights and harmonizing interfaces for coherence.
- The role of nudging and setting guidelines to direct the development of APIs in desirable ways.
Managing Profile and Account Details
Claiming APIs in TeejLab Platfrom
Adding APIs in TeejLab Platform
1. Account Verification: The video begins by ensuring the user is in the correct account by navigating to "Manage My Organization."
2. Adding a Vendor: Users are instructed to add a new vendor named Coin Cap. The process involves providing metadata such as the vendor’s logo, name, homepage, and a short description.
3. Storing API Keys: The video explains how to store the API key after registering with the vendor and obtaining the key. It also suggests recording credential information for team environments.
4. Legal Information: Users are shown how to store the vendor’s terms of service and privacy policy to ensure compliance and provide useful information for others using the API.
5. Adding API Information: The video details how to add API information, including the API version, category, homepage, and description. It also explains configuring authentication at multiple levels.
6. Endpoint Information: The process of adding endpoint information for the API is demonstrated, including specifying the endpoint URL, documentation page, and relevant parameters.
7. Authentication Configuration: The video explains configuring the authentication method, including passing the API key in the message header and specifying the correct storage location for the key.
8. Parameter Setup: Users are shown how to set up parameters, such as base and target cryptocurrencies, making them required or optional, and providing example values.
9. Testing the API: The video tests the API to ensure it works correctly, addressing any errors and making necessary adjustments to parameter settings.
10. Final Verification: The video concludes by verifying the added API details, ensuring all necessary information is recorded, and successfully running the API with required parameters.
Adding APIs with API Key Authentication
1. Introduction: The video starts with a brief introduction and a mention that this is a follow-up video on how to add APIs into the TeejLab platform.
2. Navigation: It instructs users to navigate to the "Manage My APIs" section on the TeejLab platform and click "Add Vendor."
3. Adding a Vendor: For example purposes, the video uses a vendor named Photo. It shows how to fill in the vendor name, homepage, and a short description, then download and add the vendor's logo.
4. Authentication: The video explains that many vendors require users to create an account to get an API key. It demonstrates signing in to a vendor's API portal to register and generate an API key, while emphasizing the importance of keeping the API key private.
5. Configuring the API: Users are shown how to configure the API by going to the vendor's documentation page to find the API key authentication method. The video explains how to add API details in the TeejLab platform.
6. Adding API Details: The video demonstrates adding API details, e.g., version, category, homepage, and a short description of what the API does.
7. Vendor Licenses: It shows how to add vendor licenses by copying and pasting the terms and conditions and privacy policy URLs.
8. Adding Endpoints: The video walks through adding endpoints by specifying details from the vendor's documentation, including required parameters and authentication methods.
9. Testing the API: Finally, the video tests the API by uploading a photo and executing the API call to ensure it works correctly.
10. Conclusion: The video concludes by summarizing the steps and thanking viewers for watching.
API Legal Risk Management
Users can perform automated security tests using OWASP top-10 and CIS top-20 frameworks to find and mitigate API-specific vulnerabilities. That helps enterprises in managing legal risks (such as compliance with GDPR, HIPPA, EU-US Privacy Shield, SOC2, PCI-DSS, ISO27001) and security threats (such as unauthorized access and SQL injection problems leading to data breaches) even before APIs are integrated with various SaaS/cloud products and services.
Users can also perform Software Composition Analysis to discovery embedded APIs from software applications. Users can generate security and compliance reports (Bill of Materials) to collaborate with different stakeholders. Ultimately, API Discovery™ helps enterprises in achieving their digital and data monetization objectives without compromising on their data privacy, security and integrity obligations.
Providing Details for Claiming APIs
Documenting API details are important to maintain the quality of information so that all community members or API users can benefit from using the corresponding APIs in a consistent way and efficiently.
Checking API Health
In this video, Terre Leung shows how to check the health of APIs in the API Discovery platform. Here "health" essentially means that API is responding and it's hosted within a favorable geographical location by a reliable ISP (or directly by the API provider).
Publishing Healthy APIs
Publishing to the "entire community" essentially means that you are making the APIs (which you added, configured and tested) available to other users on the platform. Note that, credentials you have used (to configure your APIs) will never be published to other community members.
Cancelling API Reviews
Top 9 Most Popular Types of API Testing
1. Smoke Testing: Verifies that the API handles basic requests and is stable enough for further testing.
2. Functional Testing: Ensures every function of the API operates as specified and meets detailed requirements.
3. Integration Testing: Checks the interaction between multiple APIs or between APIs and other system components.
4. Regression Testing: Confirms that new software updates do not adversely affect the existing functionality of the API.
5. Load Testing: Assesses the API’s ability to handle high volumes of requests and maintain performance under pressure.
6. Stress Testing: Tests the API’s durability beyond normal operational capacity to ensure it can handle extreme conditions.
7. Security Testing: Examines the API for vulnerabilities to protect against unauthorized access and data breaches.
8. UI Testing: Ensures that the API contributes to a smooth and responsive user interface.
9. Fuzz Testing: Challenges the API with abnormal input to identify potential breakdowns in handling unexpected or erroneous data.
Managing Business Risks from APIs
Unfortunately, this growing API usage also means growing cybersecurity risks. Although, APIs benefit organizations immensely through accelerated innovations, newer business models, competitive differentiation, but organizations are also negatively impacted by APIs due to their weak security posture leading to business disruptions, legal and compliance issues. Gartner has actually predicted that by 2022, API abuses will be the most frequent attack vector resulting in data breaches for web applications.
Given the importance of APIs for digital transformation at organizations, it is imperative for their Security, Compliance and Audit professionals to get a handle on APIs to manage various API related risks. In this video an overview of an API Governance framework is provided for effective API Business Risk Management. This framework is inspired by the Zero Trust model that enterprises can use as a “Swiss Knife” for reducing their API related risks. We’ll also highlight best practices and hands-on examples for API Risk Management.
Managing Legal Risks by Analyzing API Agreements
API Security - OWASP Top-10 & CIS Top-20 Security Tests
....After logging in, we navigate to "My Actions" and select "Perform Security Test" to access the security test page. This page is divided into two main test case types: OS Test and General Test. Below these options, we can view a history of previously run tests along with their details.
Key Points:
Initiating a Security Test: To start, we choose an endpoint to test against and execute the security tests, which may take some time to complete.
Viewing Results: After the tests have been executed, results are displayed on the same page. For more detailed information, each section can be expanded by clicking on it. There is also an option to expand or collapse all results at once.
Addressing Failed Attempts: If a test fails because an endpoint request has not been run, we need to go to "Manage My API" and perform the necessary tests on that endpoint. The security module is specifically designed to test APIs listed under "Manage My API" rather than public APIs.
Running General Tests: The general test section includes 23 test cases. Running these tests against an endpoint takes time, but once completed, the results and detailed descriptions of any failures are displayed. Solutions and references for resolving issues are also provided.
Reviewing Test History: We can review all the test cases run against an endpoint, and when switching to another endpoint, the test results and historical data are again accessible.
The session concludes with an overview of the security test module, highlighting its functionality and integration with the "Manage My API" section.
API Security - Automating API Testing
API Proxy Basics
1. Introduction to API Proxies: The video explains that instead of apps calling an API directly, they call an API proxy, which then calls the API. This applies to both API requests and responses.
2. Traffic Flow: It highlights that all traffic between apps and the API flows through the API proxy.
3. Benefits of API Proxies: Having the API proxy in this key position provides access to pre-coded solutions for common and complex API interactions.
4. Configurable Policies: There are over 30 out-of-the-box configurable policies that can be attached at various points in the flow to secure the API, prevent denial of service attacks, and transform message content.
5. Extending Policies: Policies can be extended using languages like Python, JavaScript, and Java.
6. Apogee Analytic Services: Apogee gathers metrics across the entire proxy flow, such as the number of messages received, response times, and errors.
7. Further Learning: Links are provided to learn more about Apogee and API proxies.
Server-Side Request Forgery (SSRF) Explained
1. Introduction to New Content Focus:
- The creator expresses the desire to balance educational content about entering the field of hacking with sharing personal experiences.
- They propose a new content direction that showcases vulnerabilities, discusses vulnerability types, and provides real-world examples.
2. Feedback Request:
- The creator seeks feedback from their audience on whether they prefer technical discussions on vulnerabilities or general discussions about bug bounties and web hacking.
3. Explanation of SSRF (Server-Side Request Forgery):
- Provides a detailed definition of SSRF and explains its significance in the context of web security. - Describes the potential impact of exploiting SSRF vulnerabilities, such as accessing sensitive internal systems.
4. Demonstration of Identifying and Exploiting SSRF:
- Uses practical examples and tools like Burp Suite to show how to identify and exploit SSRF vulnerabilities.
- Explains how to differentiate between server-side and client-side requests to confirm the presence of SSRF.
5. Practical Application and Examples:
- Demonstrates how to exploit SSRF to access internal files or systems.
- Discusses various scenarios where SSRF can be particularly dangerous, including accessing cloud service metadata and internal applications.
6. Misconceptions and Clarifications:
- Aims to clarify common misconceptions about SSRF, particularly the confusion between server-side and client-side request origins.
- Emphasizes the importance of understanding where the request originates to accurately identify SSRF vulnerabilities.
7. Conclusion and Call to Action:
- Encourages viewers to provide feedback on the new content direction.
- Expresses hope that the new focus will reduce the frequency of misidentified SSRF vulnerabilities and improve the audience’s overall understanding of web security vulnerabilities.
API Hacking
1. Introduction to API Hacking:
- The creator introduces the topic of API hacking, specifically for bug bounty programs, and mentions that the video will not cover API endpoint enumeration extensively as it is covered in other videos.
2. Tool Setup and Initial Exploration:
- Demonstrates setting up and using nmap for scanning, including tips for avoiding detection and ensuring thorough scanning.
3. Identifying API Using nmap:
- Details how to interpret nmap results to identify APIs, using the output to explore potential API endpoints.
4. API Fuzzing with 'fuff':
- Explains how to use 'fuff', a tool included in Kali Linux, for fuzzing API endpoints to discover usable paths or potential vulnerabilities.
5. Exploring API Endpoints:
- Describes how to interact with discovered APIs, exploring functionalities like user login and data retrieval, and how to handle JSON responses and errors.
6. Creating User Accounts and Gaining Access:
- Provides a step-by-step guide on how to potentially create a user account through fuzzed API endpoints, including handling JSON data and formulating proper requests.
7. Advanced Techniques and Troubleshooting:
- Discusses advanced techniques for further exploiting API vulnerabilities, such as using bearer tokens for authentication and accessing restricted areas.
8. Conclusion and Further Learning:
- Concludes the video with an invitation for viewer questions and suggestions for future content, hinting at the possibility of delving deeper into complex topics like privilege escalation within the context of API hacking.
Detecting and Managing Leaked API Keys
1. Introduction and Background:
- The creator introduces the concept of finding secrets in different types of source code through tools like Truffle Hog and a new Chrome extension designed for HTML and JavaScript.
2. Examples of Leaked Keys:
- Demonstrates how API keys can leak through front-end sources using real-world examples from popular websites.
3. Explanation of Common Vulnerabilities:
- Discusses why API keys are commonly found in front-end code, emphasizing the architecture of many SaaS applications that encourage this practice.
4. Cross-Origin Resource Sharing (CORS):
- Explains the basics of CORS and how misconfigurations can lead to security risks, allowing potentially malicious cross-origin requests.
5. Potential Risks and Implications:
- Highlights the security risks associated with leaked API keys, including unauthorized access, data breaches, and financial costs due to abuse of the exposed keys.
6. Demonstration of Finding and Testing Keys:
- Shows how to use the Chrome extension to detect and test exposed API keys in real-time as you browse, explaining how to interpret the findings.
7. Discussion on API Design and Security Practices:
- Analyzes the security practices around API key management, discussing common mistakes that lead to key leaks and how developers can mitigate such risks.
8. Real-World Consequences of Leaked Keys:
- Provides examples of how leaked API keys can be exploited by attackers to gain unauthorized access, disrupt services, or incur unauthorized charges.
9. Recommendations and Preventative Measures:
- Offers advice on how to secure API keys, including proper scoping, secure storage, and regular audits of key permissions.
10. Concluding Thoughts:
- Summarizes the importance of vigilant security practices when handling API keys and encourages the use of tools like the presented Chrome extension to help identify potential leaks.
Mastering Web API Hacking: A Comprehensive Guide to Exploiting and Securing APIs
- The content creator introduces the second phase of the bug bounty course, focusing on hacking web APIs.
- Explains the importance of understanding the scope of web APIs and how to approach them for hacking.
Feedback Request:
- Asks viewers for feedback on the updated content and format, emphasizing the relevance of the new OWASP API Top 10 for 2023.
Explanation of Web APIs:
- Provides a detailed definition of APIs, explaining their purpose for application-to-application interaction rather than human use.
- Discusses different types of APIs like RESTful, GraphQL, and SOAP, highlighting their uses and importance in modern web infrastructure.
Demonstration of Identifying and Interacting with APIs:
- Uses practical examples to demonstrate how to identify and interact with APIs, focusing on JSON and XML data formats.
- Shows how to parse and understand API responses using tools and visual aids to assist viewers new to API structures.
Practical Application and Examples:
- Demonstrates methods to discover and exploit APIs using common hacking techniques.
- Discusses various API technologies and their security implications, emphasizing GraphQL and RESTful APIs.
Misconceptions and Clarifications:
- Addresses common misconceptions about APIs, such as their complexity and the necessity to interact directly with them.
- Clarifies the differences and uses of various API types, stressing the importance of security in legacy and modern APIs.
Exploring API Architectures: Styles and Applications for Modern Software
1. Introduction to API Importance: Highlights the significance of understanding API architecture given the billions of API calls made daily, emphasizing their role as essential communication bridges in software.
2. SOAP APIs: Discusses SOAP, a mature, XML-based architecture used in scenarios requiring high security and reliability, such as financial services, but notes its complexity might not suit lighter, rapid development contexts.
3. RESTful APIs: Covers RESTful APIs, which are fundamental to internet services and utilize HTTP methods, ideal for standard web services but possibly unsuitable for real-time data needs or complex interconnected data models.
4. GraphQL: Introduces GraphQL as both an architectural style and a query language that enables precise data requests, eliminating data over-fetching or under-fetching, which optimizes network communication.
5. gRPC: Reviews gRPC, known for its high performance and use in microservices via Protocol Buffers, though it may face compatibility issues with browser clients.
6. WebSocket: Explains the use of WebSocket for applications requiring real-time, bidirectional communication, like live chats or online gaming, but may be excessive for applications without real-time data needs.
7. Webhook: Describes Webhook's use in event-driven environments, such as GitHub’s notification system, but advises against it for needs requiring synchronous communication.
5 Strategies of a Good API Design
1. Generating Identifiers: Suggests generating identifiers like order IDs at the API level rather than relying on database auto-increments, especially in distributed environments. This practice allows for asynchronous processing and avoids identifier conflicts across systems.
2. Meaningful Identifiers: Recommends creating identifiers that convey useful information at a glance, such as geographic or temporal data, which adds value beyond mere uniqueness.
3. Responsive Actions Based on State: Advises including possible actions in API responses based on the current state of the data. For example, an order might only be cancellable when it's in a pending state. This approach helps minimize client-side logic and keeps the system adaptable to changes.
4. Flexible Response Structures: Stresses the importance of designing API responses that are flexible and extendable over time without breaking existing clients. This can involve initially using objects instead of arrays to facilitate future additions.
5. Domain-Specific Language: Encourages the use of terminology that reflects the domain rather than technical jargon. This makes the API more intuitive and aligned with user expectations. The video emphasizes context-specific application of these tips and invites viewers to join a private Discord server to discuss software architecture and design further.
7 Techniques to Optimize your APIs for Performance
1. Caching: Discusses the benefits of caching responses to reduce database hits for frequently accessed endpoints with unchanged request parameters, using tools like Redis or Memcached.
2. Connection Pooling: Explains how maintaining a pool of open connections, rather than opening new ones for each API call, can significantly improve throughput and reduce latency.
3. Avoiding N+1 Queries: Addresses the N+1 query problem common in database interactions, particularly when fetching related data sets, and suggests more efficient data retrieval strategies to minimize database round trips.
4. Pagination: Recommends implementing pagination to manage large datasets, enhancing data transfer speeds and reducing client-side load.
5. Lightweight JSON Serializers: Advocates for using efficient JSON serialization libraries to expedite the process of converting data into JSON format, thereby improving response times.
6. Compression: Suggests enabling compression for large API responses to decrease data transfer volumes over the network, potentially using advanced algorithms like Brotli for better compression ratios.
7. Asynchronous Logging: Proposes asynchronous logging to prevent log writing from slowing down the main application processes, especially in high-throughput environments.
Webinar - ISACA Austin Chapter
Given the importance of APIs for digital transformation at organizations, it is imperative for their Security, Compliance and Audit professionals to get a handle on APIs to manage various API related risks. This session will provide an overview of an API Governance framework for effective API Risk Management. This framework is inspired by the Zero Trust model that enterprises can use as a “Swiss Knife” for reducing their API related risks. We’ll also highlight best practices and hands-on examples for API Risk Management.
Webinar - ISACA Sri Lanka Chapter
Webinar - York University
Webinar - University of Kentucky
IBM Tutorial - What is an API and SDK ?
Aaron Jack - What is an API?
1. Technological Integration: Frequent references to advanced tools and platforms such as NASA, Google Drive, and various software suggest a strong emphasis on technology.
2. Brand and Event References: Numerous mentions of brands (e.g., Nike, Adidas) and events (e.g., Australian Open) indicate a focus on consumer culture and popular global activities.
3. Professional and Personal Identity: The script touches on aspects of professional roles and personal identity, possibly reflecting on how these roles intersect and influence each other.
4. Cultural and Recreational Engagement: Engagement with cultural elements like YouTube and sports events points to an interest in leisure and entertainment.
5. Global Perspective and Daily Activities: The script spans global references and everyday tasks, highlighting a blend of local and international outlooks in daily life.
Krish Naik - Mastering APIs for Data Science Projects
1. Data Collection Importance: Emphasizes the critical role of data collection in data science projects, highlighting the challenges many face with relying solely on open-source datasets from platforms like Kaggle. This mirrors TeejLab's approach to innovatively sourcing diverse datasets.
2. Introduction to RapidAPI: Introduces RapidAPI as a valuable resource for accessing a wide array of public datasets, which can be used to create extensive data pipelines, a strategy also employed by TeejLab to enhance their data-driven solutions.
3. Practical Demonstration: Offers a step-by-step guide on how to use RapidAPI to fetch, process, and store data from various APIs. This includes a detailed demonstration using APIs such as a COVID-19 tracker and a movie database, exemplifying practices similar to those at TeejLab.
4. Project Management Tools and Team Collaboration: Discusses the use of project management tools like Jira and Confluence, and outlines the roles of various team members in a data science project, from domain experts to data scientists, aligning with TeejLab’s emphasis on collaborative innovation.
5. Creation and Monetization of Private APIs: Explains how to create private APIs and discusses the potential for monetizing them, providing viewers with practical insights into both technical and business aspects of API management, paralleling TeejLab's successful strategies in this area.
Statistical Learning - Multiple Regression
1. Data Collection and Purpose: The video explains that data has been collected over 19 months to predict the cost of running a factory that produces three types of products: A, B, and C.
2. Regression Model Setup: It covers the basics of linear regression, noting that the independent variables are the quantities of products A, B, and C, and the dependent variable is the factory cost.
3. Excel Tools and Configuration: Instructions are provided on how to enable the Analysis ToolPak in Excel, access the regression tool, and input the data ranges for the dependent and independent variables.
4. Interpreting Regression Output: The video emphasizes the importance of interpreting the regression output, particularly the intercept and coefficients for each independent variable.
5. Significance Testing with p-values: There is a focus on checking the p-values of the independent variables to determine their significance, with variables having p-values greater than 0.15 being excluded from the model.
6. Refining the Model: An example is provided where product A is excluded due to its high p-value, and the regression is rerun with only products B and C.
7. Prediction Calculation: The final step involves using the regression coefficients to predict the monthly factory cost based on given quantities of products B and C, resulting in a predicted cost of $45,149.21.
What is bug bounty?
- The content creator introduces a new educational series about bug bounties, focusing on guiding viewers from beginners to successful bug bounty hunters.
- They share their excitement and outline the series' scope, from understanding what bug bounties are to mastering the skills needed to earn higher bounties.
Feedback Request:
- The creator invites feedback on the series format and the content being offered.
- They emphasize interaction and community involvement as integral to the series' development. Explanation of Bug
Bounty Basics:
- Provides a detailed definition of bug bounty programs and clarifies common misconceptions about legality and scope.
- Discusses the nature of bug bounty work, highlighting it as a blend of skill, intuition, and perseverance, not a quick-rich scheme.
Demonstration of Starting in Bug Bounties:
- Uses practical examples and initial steps to engage with bug bounty platforms like Bugcrowd.
- Illustrates how to select and start with beginner
-friendly bug hunting tasks and what initial setups are most beneficial.
Practical Application and Examples:
- Demonstrates setting up an environment for bug bounty tasks.
- Discusses different types of vulnerabilities typically encountered and shares strategies on how to approach and report them effectively.
Misconceptions and Clarifications:
- Clarifies common myths about bug bounty hunting, such as the need for advanced tools and software from the start.
- Emphasizes that success in bug bounties comes from knowledge, practice, and ethical hacking principles.
Conclusion and Call to Action:
- Encourages viewers to participate actively in the bug bounty community and use the series as a stepping stone to start their bug bounty journey.
- Motivates viewers to apply the knowledge from the series to real-world bug hunting scenarios and share their progress and feedback.
Digital Transformation with Government and Public Sector APIs
Digitial Transformation in Health Care
Digital Transformation with Environment & Weather APIs
Key Points:
Exploration of APIs: She reviews three different APIs provided by Storm Glass, each related to environmental and weather data.
Astronomy API: This API provides astronomical data globally. She tests this API using the provided example coordinates for longitude and latitude. The response includes detailed astronomical data such as moon phases, moonrise, moonset, sunrise, and sunset.
Tide API: Next, she tests the Tide API, which supplies tidal data globally. Using example coordinates again, the response provides data on tide heights, times, and whether it's a low or high tide.
Weather API: Lastly, she examines the Weather API, which allows fetching weather data for specific points or areas. After executing this API, the response reveals details like humidity, precipitation, pressure, water temperature, wind direction, and wind speed.
Use Cases: Amishi discusses various practical applications of these APIs, such as public safety and emergency management, which could utilize the Tide and Weather APIs for developing safety alerts or outdoor alarms for extreme weather conditions. Another use case includes severe weather tracking, which could benefit travelers or those needing to manage risks for outdoor projects or assets.
Demonstration: Amishi provides live demonstrations for each API, showcasing how to execute them and interpret the results.
Potential Applications: She also touches on how these APIs can be integrated into applications, particularly in drone operations where weather conditions such as wind speed and direction are crucial for pre-flight checks.
The session concludes with an invitation to check out Amishi's previous video on developing applications using APIs from the TeejLab Discovery platform, helping viewers understand how to integrate these APIs into their own projects.
Digital Transformation in Sports and Entertainment Industry
Key Points:
Competition Information API: Amishi tests an endpoint that retrieves all matches of the Champion League. The execution returns details about various matches without requiring any parameters.
Match Information API: This API provides information on today's matches. The response includes details about the away team, home team, and odds.
Player Information API: She uses an endpoint that lists specific player details by ID. The response includes comprehensive information about the player's birth country, birth date, nationality, and position.
Team Information API: This API shows all matches for a particular team based on the team ID. The response details the different matches the team has participated in.
Amishi then discusses potential use cases for these Football APIs, including:
-Creating a live score app or website: These APIs provide data that can be used to show live scores, match statistics, and information about teams and players.
-Fantasy football platforms: Necessary player information for virtual team creation can be accessed through these APIs.
-Historical data analysis: The APIs allow access to historical data for trend analysis, team statistics, and player performance evaluation.
-News media platforms: These APIs can support sports-related news applications by providing fresh information about players, matches, and events.
Amishi concludes by highlighting that while the video focuses on football APIs, the TeejLab platform also hosts APIs for other sports like rugby, handball, and volleyball, which could similarly benefit projects related to those sports.
Digital Transformation in News and Media Industry
Key Points:
Everything News API: This API returns news articles related to a specific keyword. Amishi tested it using "music" as the keyword. The response included various news articles, providing details such as the author, content, and a URL to the full article.
Sources API: This API provides a list of all news sources used by the vendor. The execution of this API yields details about each source, including category, description, country, language, and a URL to the homepage.
Top Headlines News API: This API fetches top headlines from a specified country. She used Canada as the test case, and the response included top news articles with details about the author, publishing date, and a URL.
Use Cases Discussed:
News Aggregation App or Website: These APIs can be utilized to create platforms similar to Google News, aggregating articles from various sources without needing to gather this data manually.
Competitive Intelligence Program: Businesses can use these APIs to gather information on competitors and market trends, aiding in informed decision-making.
Sales Triggers Recognition: By monitoring news for events like product launches and new partnerships, companies can identify opportunities for customer engagement.
Amishi concluded the video by discussing the significance of integrating these news APIs into applications and directed viewers to another video that guides on developing applications using APIs from the TeejLab platform.
Digital Transformation with Transportation and Logistics APIs
Key Points:
Transit Buses API: This API provides vehicle information for buses in the Lower Mainland. Amishi tested this API without any filters, and the response included details such as the bus destination, direction, time, and route number.
Transit Routes API: This API returns different bus routes. Amishi tried the first endpoint, requiring the format type and bus stop number. The response showed the various routes serving the specified bus stop.
Transit Stops API: This API offers information on various transit stops at a given location. Using example latitude and longitude values, the response included details such as city, stop number, wheelchair access availability, and street location.
Use Cases Discussed:
Transit App: Utilizes the user's smartphone GPS to display nearby transit options and their departure times, enhancing travel convenience based on current location and time.
Radar for Metro Vancouver Buses: Allows users to input a route number to see all buses currently running on that route in real-time, useful for tracking available buses for a known route.
Transit B: Enables users to find nearby stops and list available routes. Users can favorite stops and routes for easy access later, ideal for daily commutes or frequent trips.
Live TransLink Vancouver: Users select a route and track it in real-time on a map, helping to plan trips with up-to-date bus and stop information.
The video concludes by highlighting various transit-related applications developed using these APIs and suggests other potential non-transit related applications such as city exploration apps, finance trackers with commute costs, and event schedulers. For those interested in integrating these APIs into their own projects, Amishi recommends checking out her previous video on using APIs from the TeejLab platform.
Digital Transformation with eCommerce & Trade APIs
Key Points:
Categories API: This API allows exploration of the different categories on the Best Buy website. The required parameter is the format for the response, which Amishi leaves as JSON. The response lists various categories such as anniversary gifts, computing, video games, and movies.
Products API: Provides details on pricing, availability, specifications, and images for Best Buy products. Using a product identifier, the response includes detailed information about a MacBook Air, including its category, color, condition, and an image URL.
Recommendations API: Offers information on the most viewed and trending Best Buy products. The execution requires no parameters and returns data including customer reviews, product images, names, and prices.
Stores API: Gives details about Best Buy store locations in the United States and Puerto Rico, including addresses, hours, and services offered. The only required parameter is the response format, set to JSON. The response includes information about various Best Buy locations.
Use Cases Discussed:
Price Comparison Tools: These APIs can be used to develop applications or browser extensions that compare product prices across different retail platforms, fetching pricing information for Best Buy products.
Online Shopping Assistance: An AI-powered shopping assistant could use these APIs to provide personalized recommendations and shopping advice.
Store Locator Services: For applications that help users find nearby stores, the Best Buy Store API can provide location details along with hours and services offered.
Shopping Applications: Developers looking to create platforms where users can browse products, check prices, reviews, and make purchases will find these APIs useful for integrating Best Buy products.
The video concludes by highlighting the versatility of the Best Buy APIs in developing a variety of e-commerce applications. For more details on integrating these APIs into projects, viewers are encouraged to watch Amishi's previous video on developing applications with APIs from the TeejLab platform.
Data Sheet - API Discovery Manager
Discovery is enabled via world’s first comprehensive API KnowledgeBase™ - a curated repository of public and private APIs with advanced search capabilities to find APIs by needs, vendors, industries, sample responses, etc. Explore and analyze associated API agreements, regulatory/compliance requirements while making “one-click” live calls to test and compare responses. An ideal platform for benchmarking APIs and picking the most suitable ones that meet your price-value-risk criteria. Refer to the attached data sheet for more details.
Data Sheet - API Security Manager
Solution Brief - Digital Asse