This document provides an overview of web service hacking presented by Ömer Çıtak at BILMÖK in 2017. It begins with introductions and then defines key vocabulary related to APIs, REST, authentication methods, and status codes. It also lists the OWASP Mobile Top 10 security risks and provides brief explanations of "Insecure Data Storage", "Insecure Communication", and other categories. Screenshots are included from a demo on RESTful routes. The presentation emphasizes the importance of security when developing web services and APIs.

1. Web Servislerinin
Hacklenmesi
Ömer Çıtak
XIII. BiLMÖK, 2017

2. whoami
Security Researcher @ Netsparker Ltd.
Developer @ Another Times
Writer @ Ethical Hacking “Offensive & Defensive” Book
Blog: omercitak.com
All Social Platform: @Om3rCitak

3. http

4. ?

5. apple

6. http web service

7. vocabulary
● API => Application Programing Interface

8. vocabulary
● API => Application Programing Interface
● REST => REpresentational State Transfer

9. vocabulary
● API => Application Programing Interface
● REST => REpresentational State Transfer
● RESTful => REpresentational State Transfer ful

10. vocabulary
● API => Application Programing Interface
● REST => REpresentational State Transfer
● RESTful => REpresentational State Transfer ful
● GET, POST, PATCH/PUT, OPTIONS, DELETE

11. vocabulary
● API => Application Programing Interface
● REST => REpresentational State Transfer
● RESTful => REpresentational State Transfer ful
● GET, POST, PATCH/PUT, OPTIONS, DELETE
● Route

12. vocabulary
● API => Application Programing Interface
● REST => REpresentational State Transfer
● RESTful => REpresentational State Transfer ful
● GET, POST, PATCH/PUT, OPTIONS, DELETE
● Route
● Basic Authentication

13. vocabulary
● API => Application Programing Interface
● REST => REpresentational State Transfer
● RESTful => REpresentational State Transfer ful
● GET, POST, PATCH/PUT, OPTIONS, DELETE
● Route
● Basic Authentication
● 200, 201, 400, 401 etc...

14. vocabulary
● API => Application Programing Interface
● REST => REpresentational State Transfer
● RESTful => REpresentational State Transfer ful
● GET, POST, PATCH/PUT, OPTIONS, DELETE
● Route
● Basic Authentication
● 200, 201, 400, 401 etc…
● Proxy

15. restful routes

16. OWASP Mobile Top 10
1. Improper Platform Usage
2. Insecure Data Storage
3. Insecure Communication
4. Insecure Authentication
5. Insufficient Cryptography
6. Insecure Authorization
7. Client Code Quality
8. Code Tampering
9. Reverse Engineering
10. Extraneous Functionality

17. OWASP Mobile Top 10
Insecure Data Storage
This new category is a combination of M2 + M4 from Mobile Top Ten 2014. This
covers insecure data storage and unintended data leakage.

18. OWASP Mobile Top 10
Insecure Communication
This covers poor handshaking, incorrect SSL versions, weak negotiation, cleartext
communication of sensitive assets, etc.

19. OWASP Mobile Top 10
Insecure Authentication
This category captures notions of authenticating the end user or bad session
management. This can include:
● Failing to identify the user at all when that should be required
● Failure to maintain the user's identity when it is required
● Weaknesses in session management

20. OWASP Mobile Top 10
Insufficient Cryptography
The code applies cryptography to a sensitive information asset. However, the
cryptography is insufficient in some way. Note that anything and everything related
to TLS or SSL goes in M3. Also, if the app fails to use cryptography at all when it
should, that probably belongs in M2. This category is for issues where
cryptography was attempted, but it wasn't done correctly.

21. OWASP Mobile Top 10
Insecure Authorization
This is a category to capture any failures in authorization (e.g., authorization
decisions in the client side, forced browsing, etc.). It is distinct from authentication
issues (e.g., device enrolment, user identification, etc.).

22. demo

23. where is the güvenlik?

24. thanks
www.omercitak.com
All Social Platform: @Om3rCitak