Exploring API abuse scenarios
API abuse is related to the unexpected use of an API in a way that deviates from its intended purpose or project/design. This can naturally uncover security vulnerabilities, which in turn can cause data breaches and/or service interruptions. Some common ways of abusing an API include the following:
- Credential stuffing: By using stolen credentials, access to the API is gained.
- Data scraping: Consists of exfiltrating large volumes of data from an API, which usually violates terms of service or its privacy policies.
- Endpoint discovery: It’s accomplished with the use of automation tools to discover and exploit “hidden” (forgotten or undocumented) API endpoints.
- Mass assignment: You send unexpected data fields to the endpoint to manipulate internal object properties.
- Parameter tampering: Consists of changing API parameters to be able to access data or features that would be denied or restricted by default.
- Rate...
