API6:2023 — Unrestricted Access to Sensitive Business Flows

Slide 26 · The Matrix

Which mitigations stop which attacks?

Real incidents and scenarios mapped to the defenses that would have stopped them.

BREACH — Ticketmaster (2022) · Millions of fans excluded · Inventory Monopolization

Bots held millions of tickets simultaneously in carts; presale collapsed

No per-account ticket limit, no short cart timeout, no bot detection capable of stopping coordinated multi-account operations at scale.

Stopped by: MIT 01 (limit: max 4 tickets per verified account) + MIT 02 (timeout: cart items released after 8 minutes if not purchased) + MIT 03 (fingerprinting: detect parallel sessions from same operator) + MIT 06 (phone verification: presale requires verified phone number)

INCIDENT — Sneaker Bots · Ongoing · Machine-Speed Checkout

Limited releases sell out in under 10 seconds; 40% of traffic is bots

Bots complete checkout flows in milliseconds. No minimum completion time check. No bot detection that keeps pace with stealth browser automation.

Partially stopped by: MIT 04 (CAPTCHA on checkout — raises cost but not a complete block) + MIT 05 (human-speed check: checkout in 300ms is flagged) + MIT 03 (fingerprinting: headless browser detection) + MIT 02 (short reservation windows)

OWASP — Referral Farming · Financial loss · Reward Abuse

Thousands of fake accounts, each triggering a referral payout

No phone verification. Disposable emails accepted. No referral velocity limits. No anomaly detection on reward issuance rate.

Stopped by: MIT 06 (phone verify: one phone = one referral account) + MIT 01 (limit: max referral rewards per account per period) + MIT 07 (monitor: 500 referrals in one hour from one campaign triggers alert)

OWASP — Quantity Bypass · Inventory manipulation · UI Limit Only

Bot sent quantity=500 directly to the purchase API, bypassing the UI’s limit of 1

Quantity limit only enforced in the UI dropdown. API accepted any quantity value. One request purchased 500 units.

Stopped by: MIT 01 (server-enforced: if quantity > 1, reject with 422 before processing) — this is the most direct fix and the only required one for this specific failure

← Back Ready to test yourself? →