Testing for information leakage

Cool! So, you had access to a data mass, obtained via data exfiltration, social engineering, or any other pentesting technique, and you just learned how to extract data from such mass with a few rather nice tools. However, how can you possibly test an API endpoint to verify whether it is vulnerable to leaking something you’re looking for? That’s what we’re going to see here. It is not redundant to say that we are not testing real public API endpoints because we obviously do not have access for doing so. Consider the teachings here to be for educational and professional purposes only.

We will use our controlled lab environment to put some API routes to run and play with them a bit to understand to which extent they can disclose data that is supposed to be protected. The first thing you need to have is the data itself, of course. You can either pick a file with dummy data you may already have or run the script that follows. This...