How Hackers Find Data Breaches in Your APIs

Today, we increasingly rely on various cloud-based solutions. As users, we often want all software and systems to communicate with each other. For example, invoices from the accounting program need to be forwarded to the CRM system. And product stock from the warehouse software also needs to be visible on the webshop.

All of this is made possible through the use of APIs (Application Programming Interfaces). However, these APIs also come with risks. At Tozetta, Hacker Ian van der Wurff specializes in, among other things, hacking APIs. In this blog, he explains in detail how cybercriminals operate, as well as how he himself maps out cyber risks around APIs.

Vulnerabilities in APIs

When it comes to API security, it's crucial to understand how hackers can find and exploit vulnerabilities. APIs form an important part of modern web applications and are therefore an attractive target for malicious hackers.

A common method hackers use to find vulnerabilities in APIs is running automated scans. These scans can be performed using specialized tools that scour the internet for public APIs and then automatically try to find weak spots. These can, for example, be unsecured endpoints that expose sensitive information to the outside world.

A good example of this is an Insecure Direct Object Reference (IDOR)

Imagine a scenario where you create an account on a dating website, and during registration you leave behind various pieces of information. Think of:

• First name / Last name

• Age

• Phone number

• City of residence

• Email address

• Interests

As soon as you go to your profile, you see the following URL appear in the search bar:

Example

https://api.voorbeelddatingsite.nl/users?accountnum=1542362

"accountnum": {
"userid": "1542362",
"name": "Bob de Boer",
"tel": "0612345678",
"age": "56",
"email": "bob@voorbeeldmail.nl",
"interests": "woman"
}

Hackers could now try to guess whether they can find accounts between 0 - 1542362.

If there is no restriction on the relevant endpoint, the (personal) data of other people could be leaked and end up in the hands of malicious users.

Example

GET https://api.voorbeelddatingsite.nl/users?accountnum=1542300

HTTP/2 200 OK
"accountnum": {
"userid": "1542300",
"name": "Alice de Jong",
"tel": "0687654321",
"age": "43",
"email": "alice@voorbeeldmail.nl",
"interests": "men"
}

Often, the web application uses a token to place restrictions on a particular user, so that only that user can edit or read their own profile. Unfortunately, this is often forgotten in the mobile application.

Want to stay up to date on the latest vulnerabilities?

More than 50 vulnerabilities are added to the Common Vulnerabilities and Exposures database (CVEs) every day. It's almost impossible to independently stay up to date on all these vulnerabilities. Nevertheless, at Tozetta we try to structurally provide insight into the vulnerabilities in your software and systems. We offer our weekly Vulnerability Update free of charge, where we share this kind of article every week.

But if you want to know more about structurally gaining insight into vulnerabilities in software and systems, read more about our Hacking as a Service solution. In addition to regular pentesting, we also offer a security monitoring tool that scans your web applications and/or internal network daily for these countless CVEs.

Or read more about Hacking as a Service >>