API9:2023 — Improper Inventory Management

Slide 9 · Two Attack Patterns

Version downgrade and environment pivot — both exploit surfaces the team forgot to secure.

Two techniques, same root cause: the real attack surface is larger than the documented one.

Pattern 1: Version Downgrade

Target: an old API version with weaker security

Attacker discovers v1 via path fuzzing (/api/v1/, /api/legacy/)

v1 lacks auth, rate limiting, or patched vulnerabilities that v2 has

Attacker calls v1 directly to bypass all v2 security controls

Exploits capabilities removed from v2 (permissions, bulk operations)

Pattern 2: Environment Pivot

Target: a non-production environment accessible from the internet

Attacker discovers staging via subdomain enumeration (staging-api., dev-api., test.)

Staging has real or realistic data, weaker auth, debug mode on

Attacker extracts data directly from staging, or uses staging as a reconnaissance platform

Maps the API surface for use against production

Discovery is the prerequisite

Both patterns require the attacker to find the forgotten surface. Discovery tools: path/word fuzzing (/api/v1/, /api/v2/, common paths), subdomain enumeration (certificate transparency logs, DNS brute force, staging-api.company.com), JavaScript file analysis (old API paths referenced in frontend JS), Google dorking (cached URLs), and Shodan for exposed services. None of these techniques are sophisticated — they’re all automated and freely available.

← Back Pattern 1 mechanics →