How deeply does Secure APIs cover zero-day vulnerability?

Defines the flaw and explains WAF filtering, but stops short of describing zero-day discovery, patching, or incident response.

Zero-day vulnerability

As explained in Secure APIs

A zero-day vulnerability is a security flaw for which no known fix is available.

A zero-day vulnerability is a security flaw for which no known fix is available. It matters because attackers may exploit such flaws before normal defenses or patches exist. section 9.4

A web application firewall (WAF) can add protection by sitting as a reverse proxy in front of APIs and inspecting requests for malicious behavior. It may block suspicious traffic or clean the input, but cleaning can create bypass risks. section 9.4

A request that defeats weak filtering

An attacker targets /payments with a SQL-injection filter such as "' or 1=1--". Obfuscating it as "+o//r+1=1--" may evade pattern matching, after which sanitization can restore executable SQL. Consequences include unexpected behavior, unauthorized records, or service disruption.

How Secure APIs covers it

liveBook manning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

advanced persistent threatused by · An advanced persistent threat is a targeted, sustained cyberattack campaign in which a capable adversary maintains unauthorized access to pursue specific objectives, often while evading detection.
web application firewalladdressed by · A web application firewall is a security system that inspects and filters application-layer web traffic to detect or block malicious requests targeting web applications and APIs.
software updateaddressed by · A software update is a change applied to existing software to modify or improve its behavior, correct defects or vulnerabilities, or add functionality.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.