Uncovering Hidden APIs: How One Forgotten Endpoint Made Me $500
1 min read
Summary
Abhijeet Kumawat highlights an incident where finding a forgotten about API endpoint enabled him to gain easy access to a well-known domain’s system and make $500 in the process.
The lesson to be learnt from this incident is that while security is of paramount importance, sometimes security focus can be on “brake ins” with efforts directed towards strong passwords and fancy authentication processes,
When actually it is often simply forgotten legacy issues that can provide the easiest access into systems.
The article urges security experts to divert some of their focus away from looking at modern, flashy security issues, and spend more time considering legacy issues and looking for undocumented and forgotten API endpoints as these are often left unauthenticated, are able to bypass modern security controls and can often expose sensitive data.
These are areas that are rarely tested by fellow bug hunters, hence the $500 windfall.