Slide 14 of 28
Part 3 · Attack ScenariosSlide 14
PART 3
Attack Scenarios
Slides 14–17 · OWASP examples in plain English
Slide 14 · Scenario 1
One request. Millions of records returned.
OWASP Scenario #1 — no maximum page size on a paginated list endpoint.
📄 OWASP API Security Top 10 · 2023 · API4 · Scenario 1
SETUP
A social network's "followers" list endpoint.

A social network exposes an endpoint to retrieve a user's followers: GET /api/users/{id}/followers?count=10. The count parameter is documented as defaulting to 10 and is intended to limit the results per page.

The developer implemented the parameter but forgot to set a maximum. The endpoint accepts any value for count — including very large numbers.

The exploit: An attacker calls GET /api/users/1/followers?count=99999999. The API queries the database for up to 99,999,999 follower records. The database runs a full table scan. The API tries to serialize millions of objects into a single JSON response. The server's memory spikes. The database is saturated. The response takes minutes to return — or the server crashes. Every other user's request fails during this time.
One request. Site down.

This scenario requires exactly one attacker making one request. No botnet. No coordination. No special tooling. Just a number in a URL parameter. The absence of a max page size turns a single API call into a denial-of-service weapon.

← Back Scenario 2 →