OWASP API Security Top 10 - 1

Open Worldwide Application Security Project (OWASP) is a non-profit and collaborative online community that aims to improve application security via a set of security principles, articles, documentation etc. Back in 2019, OWASP released a list of the top 10 API vulnerabilities, which will be discussed in detail, along with its potential impact and a few effective mitigation measures. 

We have split this room into two parts. In Part 1, you will study the top 5 principles, and in Part 2, you will learn the remaining principles.

• Best practices for API authorisation & authentication
• Identification of authorisation level issues
• Handling excessive data exposure
• Lack of resources and rate-limiting issues

Learning Pre-requisites
An understanding of the following topics is recommended before starting the room:

• How websites work
• HTTP protocols & methods
• Principles of security
• OWASP Top 10 (2025) module

Connecting to the Machine
We will be using Windows as a development/test machine along with Talend API Tester - free edition throughout the room with the following credentials:

• Machine IP:  MACHINE_IP 
• Username:   Administrator
• Password:    Owasp@123

You can start the virtual machine by clicking Start Machine. The machine will start in a split-screen view. In case the VM is not visible, use the blue Show Split View button at the top-right of the page. Alternatively, you can connect with the VM through Remote Desktop using the above credentials. Please wait 1-2 minutes after the system boots completely to let the auto scripts run successfully that will execute Talend API Tester and Laravel-based web application automatically.

Let's begin!