Data attacks
Data attacks (covered in Chapter 3, Understanding Common API Vulnerabilities) are one of the most common attack vectors for an attacker since, inevitably, the data is most valuable on the black market. While data attacks are most commonly read attacks (mapping to the API3:2019 — Excessive data exposure category section), the write attack (mapping to API6:2019 — Mass assignment) can be damaging to an API since this can be used to modify permissions and confidential data of users. Let us look at both types of data attacks.
Excessive information exposure
The numerous API breach examples covered in Chapter 4, Investigating Recent Breaches, have one thing in common: they all involve excessive information exposure. APIs can expose excessive information in several ways, and as an attacker, you need to know where to look for it.
The most obvious place is in the response itself — always make sure you are looking at the API responses either in your...
