API9:2023 — Improper Inventory Management

Slide 12 · Pattern 2 Mechanics

Subdomain enumeration → Staging with real data → Direct access or production roadmap

How attackers find non-production environments and what they do once inside.

THE SETUP

A healthcare API with a staging environment that was given a public IP for a demo.

api.healthapp.com — production, fully secured, HIPAA-compliant

staging-api.healthapp.com — created six months ago for a demo with a potential enterprise client. Given a public IP. Demo completed. Public IP never removed. Uses a copy of production data from three months ago. Auth configured as “accept any token” for demo convenience. Debug mode on.

1️⃣

Attacker enumerates subdomains

Certificate transparency logs (crt.sh) show all SSL certificates ever issued for *.healthapp.com — including staging-api.healthapp.com. Alternatively: DNS brute force tries staging, dev, test, qa, demo, api-staging as subdomain prefixes.

2️⃣

Attacker discovers the auth accepts any token

Sends Authorization: Bearer test123. Gets HTTP 200 with patient data. Staging was configured to accept any token for demo purposes — never changed. Full read access to three months of real patient records with no valid credential.

3️⃣

Attacker uses staging errors to map production

Debug mode on staging returns full stack traces. Attacker learns: the framework, internal service names, database table structure, and API endpoints not exposed in the public docs. This reconnaissance informs attacks against the production API.

← Back Real incident: USPS API →