Data Exposure and Sensitive Information Leakage

This chapter starts the fourth part of our book, which is about advanced API techniques. We will better understand the inherent problems of data exposure and sensitive information leakage that unpatched or badly configured API endpoints can suffer. We will tackle the nuances of how this can happen and ways of taking this in our favor as API pentesters.

Either by digesting some data masses or by taking a ride on previous pentesting findings, we will learn how data or sensitive information can be detected among other garbage or less valuable assets. This can save you time not only when conducting a pentest but also when planning to hit the final target of a coordinated attack. Some testers establish the scope of their work on exfiltrating some data from the endpoint, whereas others work to get it down (by abusing their network, for example). You will learn the techniques and understand how such problems can be avoided when configuring...