‫-: Hi, welcome to the last challenge.
‫Now we're gonna finish this up
‫and also have our closure in this lecture.
‫As you can see in the API 10
‫it says that nothing has been logged or monitored.
‫You caught us
‫and over here we have a get flag endpoint.
‫I believe this is a simple one.
‫He says that, I'm not kidding.
‫So let's go to API nine.
‫Of course.
‫Let's disable this intercept
‫and I believe we can close this down.
‫Okay,
‫and here you go.
‫Now, if I go to API 10,
‫as you can see I have to turn off the proxy
‫from here as well in order make to make this work
‫because Burp Suite was open all the time.
‫Now, if I come over here to get Flag API
‫and just send a request,
‫as you can see, we get the flag.
‫So this is a free one.
‫It says that, Hey, I didn't log
‫or monitor all the requests you have been sending.
‫That's on me.
‫So the idea over here is that
‫the outer
‫the creator of this challenge
‫didn't want us to go through hell in the last API.
‫And also he wanted us to remind that
‫we have to log everything.
‫Like we have to log this request and responses
‫in order to have a secure, completely secure API.
‫Because I have been hacking all this endpoints
‫so far, right, for the last three hours
‫and it appears that they didn't even log it in
‫so they don't know what the hell was going on.
‫So I'm going to close everything down.
‫Okay, we are done over here.
‫Now, I hope you have learned about the Postman usage.
‫Now you can use it fluently, right?
‫Maybe you learned about the Burp Suite a little bit more.
‫And most importantly, I believe you learned
‫about the API security,
‫how to find vulnerabilities in the endpoints,
‫and how to make them secure.
‫Now, this is a great way to pen test
‫and earn some bug bounty money.
‫Of course, if you are allowed to do so,
‫and again maybe you don't get that kind
‫of detailed documentation maybe you will,
‫but you remember that you can just find the endpoints
‫by just clicking on the website
‫and analyzing it on the Burp Suite
‫or analyzing the mobile application as well
‫using Burp suite, using it emulator.
‫Once you get the end point, then it's all on you.
‫And don't forget to disable this host from the Digital Ocean
‫or wherever you have created the server
‫so that your credit card won't get charged.
‫So far so good.
‫I hope you enjoyed this section.
‫We're gonna stop here and continue within the next one.