Prepare for the Appocalypse - Exposing Shadow and Zombie APIs

Shadow APIs are undocumented endpoints exposed through misconfiguration or human error, while zombie APIs are forgotten endpoints left running after an upgrade or planned shutdown. Both sit outside security review and both carry real risk. The talk illustrates this with scenarios: an old API version kept alive, a debugging library that registers routes in production, an outdated package, a wildcard route, and a gateway missing authentication.

Attackers find these endpoints through brute forcing, DNS history, decompiled mobile apps, error messages, logs and bug bounty scopes. Defenders can reconcile what is actually served with an OpenAPI specification, using visibility extensions and validation in gateways and CI/CD pipelines. Telemetry, clear service ownership and threat modelling also help, and framework-specific discovery was covered for Express, Spring Boot and Flask.

The live demo ran a deliberately vulnerable Node.js application, captured its router registration logs and parsed them into an endpoint list. After normalising path parameter names, a Spectral linter compared that list against the Swagger file and flagged routes that were exposed but missing from the specification. Scripts and workshop material were shared afterwards. The practical takeaway is to continuously inventory served endpoints and check them against specs.