PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

What Vuln Scanners Miss in API Testing

bugcrowd.com | tool | #access-control | #api-security | #vulnerability-scanning | #bugcrowd | #authorization | #automated-testing | #broken-authorization
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Luke Stephens shows how automated checks miss broken API authorization: an endpoint can pass QA while leaking users' home addresses to unauthenticated callers due to untested role restrictions.
Published
Collected

Related coverage

blog · bugcrowd.com
Does agentic pen testing replace vulnerability scanning?
Bugcrowd on why agentic pen testing doesn't replace scanning: scanners flag what might be wrong, agentic testing proves what is exploitable, and layering both closes coverage gaps.
blog · bugbunny.ai
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
Insecure direct object reference: the app exposes an object ID but never checks ownership, tenant or role—one user reads another's data; fix with centralized object authorization and negative tests.
blog · labs.cognisys.group
The Golden Role How a Simple API Logic Flaw Unlocked an Entire SaaS Platform
In a true black-box assessment, the engagement begins with minimal information: a target URL and no prior knowledge of the application’s architecture, credentials, or codebase. During a recent engagement targeting a multi-tenant SaaS platform, our initial objective was to establish initial access through standard user provisioning.
blog · netspi.com
Detecting Authorization Flaws in Java Spring via Source Code Review (SCR)
Broken access control often slips past dynamic testing. This article shows how secure code review of Spring annotations, expressions, and filters surfaces Java Spring privilege escalation paths early.
blog · samcurry.net
Hacking Starbucks and Accessing Nearly 100 Million Customer Records
A Starbucks gift-card purchase tipped Sam Curry to suspicious /bff/proxy/ API calls; probing the backend-for-frontend routing ultimately exposed nearly 100 million customer records.
tool · wiz.io
Wiz achieves Red Hat Vulnerability Scanner Certification
Wiz earns Red Hat Vulnerability Scanner Certification: for Red Hat images and packages, Wiz now draws vulnerability data exclusively from Red Hat feeds, cutting false positives.
Back