TMI, the kinds of data your applications are leaking

The talk opens with how attackers locate exposed API endpoints. Enumeration starts with DNS lookups for api subdomains, then moves to content discovery tools that rely on large wordlists of common routes. Hunters also check for default paths such as WordPress admin and XML-RPC files, inspect mobile traffic through an intercepting proxy, unpack Android app packages for embedded endpoints, and search public API catalogs and code repositories for specs and leaked keys.

The middle covers recurring mistakes: authentication headers that are not properly enforced, tokens accepted across tenants on a shared platform, registration errors that reveal whether an account exists, and verbose messages that help attackers. Credential stuffing often leads to account takeover, and stored payment data turns that into fraud, alongside gift card balance guessing and inventory hoarding. A live Burp demo showed a modified query parameter returning user records from another community on the same platform, and exposed OpenAPI specs and WordPress manifests gave an attacker a roadmap.

The closing section covers signals of automated abuse, such as one IP address trying thousands of usernames, unusual browser user agents hitting app endpoints, traffic from countries the business never serves, and sequential order number scans. Recommended practices include keeping API specs out of public reach, returning generic error messages, inventorying forgotten endpoints, reviewing logs, and testing apps through a proxy, with a deliberately vulnerable API as a training aid.