Reference Registry — API Security

Propósito

Esta nota es la semilla específica de API security para el registro de referencias de ciberseguridad más amplio.

Usala para: - estandarizar referencias para notas de API security - mantener la calidad de las fuentes consistente - ayudar a asignar referencias sin inventar sets de fuentes débiles - hacer más fácil expandir notas futuras de API security

Regla de fuente de verdad

Para notas de API security, este registro es la fuente de verdad primaria.

Usalo junto con: - <a href="api-security/index.html">API Security Index</a> para orden de estudio y estructura de rama - <a href="reference-registry.html">Cybersecurity Reference Registry</a> como fallback más amplio solo cuando esta nota no cubre todavía un tema de API security

Política de selección de referencias

Prioridad de fuentes

estándares oficiales y documentación de proyectos
labs oficiales y entrenamiento práctico
guías de testing y cheat sheets
investigación de alta señal
fuentes secundarias solo cuando agregan valor claro

Objetivo por nota

mínimo 2 referencias
ideal 3 referencias
evitar inflar notas con listas largas

Etiquetado

Usar: - Fundamental - Testing / Lab - Investigación / Deep Dive - Docs Oficiales

Mapa de temas de API security

api-security-top-10

Referencias preferidas: - Fundamental: OWASP API Security Top 10 2023 — https://owasp.org/API-Security/editions/2023/en/0x00-header/ - Fundamental: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Fundamental: OWASP REST Security Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

authorization

Referencias preferidas: - Fundamental: OWASP Authorization Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html - Fundamental: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger access control — https://portswigger.net/web-security/access-control

broken-object-level-authorization

Referencias preferidas: - Fundamental: OWASP API1:2023 Broken Object Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa1-bola/ - Fundamental: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger access control / IDOR — https://portswigger.net/web-security/access-control/idor

broken-function-level-authorization

Referencias preferidas: - Fundamental: OWASP API5:2023 Broken Function Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa5-bfla/ - Fundamental: OWASP Authorization Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html - Testing / Lab: PortSwigger access control — https://portswigger.net/web-security/access-control

broken-authentication

Referencias preferidas: - Fundamental: OWASP API2:2023 Broken Authentication — https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ - Fundamental: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

api-auth-flaws

Referencias preferidas: - Fundamental: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Fundamental: OWASP API2:2023 Broken Authentication — https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ - Testing / Lab: PortSwigger authentication vulnerabilities — https://portswigger.net/web-security/authentication

jwt-attacks

Referencias preferidas: - Fundamental: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Fundamental: OWASP JSON Web Token for Java Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.html - Testing / Lab: PortSwigger JWT attacks topic — https://portswigger.net/web-security/jwt

token-lifecycle

Referencias preferidas: - Fundamental: OWASP Authentication Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html - Fundamental: OWASP API2:2023 Broken Authentication — https://owasp.org/API-Security/editions/2023/en/0xa2-broken-authentication/ - Fundamental: OWASP Cheat Sheet Series — https://cheatsheetseries.owasp.org/

broken-object-property-level-authorization

Referencias preferidas: - Fundamental: OWASP API3:2023 Broken Object Property Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa3-bopla/ - Fundamental: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: OWASP WSTG API testing: excessive data exposure — https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/03-Testing_for_Excessive_Data_Exposure

excessive-data-exposure

Referencias preferidas: - Fundamental: OWASP WSTG API testing: excessive data exposure — https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/03-Testing_for_Excessive_Data_Exposure - Fundamental: OWASP API3:2023 Broken Object Property Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa3-bopla/ - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

mass-assignment

Referencias preferidas: - Fundamental: OWASP API Security Top 10 2023 — https://owasp.org/API-Security/editions/2023/en/0x11-t10/ - Fundamental: OWASP API3:2023 Broken Object Property Level Authorization — https://owasp.org/API-Security/editions/2023/en/0xa3-bopla/ - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

api-rate-limiting

Referencias preferidas: - Fundamental: OWASP API4:2023 Unrestricted Resource Consumption — https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/ - Fundamental: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger API testing — https://portswigger.net/web-security/api-testing

api-inventory-management

Referencias preferidas: - Fundamental: OWASP API9:2023 Improper Inventory Management — https://owasp.org/API-Security/editions/2023/en/0xa9-improper-inventory-management/ - Fundamental: OWASP API Security Project — https://owasp.org/www-project-api-security/ - Testing / Lab: PortSwigger API testing and OWASP alignment — https://portswigger.net/web-security/api-testing/top-10-api-vulnerabilities

polymorphic-deserialization

Referencias preferidas: - Fundamental: OWASP Deserialization Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html - Fundamental: OWASP API8:2023 Security Misconfiguration — https://owasp.org/API-Security/editions/2023/en/0xa8-security-misconfiguration/ - Testing / Lab: PortSwigger Exploiting insecure deserialization — https://portswigger.net/web-security/deserialization/exploiting - Investigación / Deep Dive: Moritz Bechler, "Java Unmarshaller Security" (marshalsec) — https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf - Docs Oficiales: ysoserial.net — https://github.com/pwntester/ysoserial.net

Reglas de uso del registro

elegir el conjunto más pequeño de referencias más fuertes para cada nota exacta
no asignar links genéricos ciegamente
preferir documentación oficial y labs sólidos
si una futura nota de API security está ausente de este registro, mapearla al tema padre más cercano primero