API9:2023 — Improper Inventory Management

Slide 24 · MIT 06

Automated endpoint discovery — find what you don’t know about before attackers do.

Inventory built from documentation finds what was documented. Discovery scanning finds what exists.

What discovery scanning does

Automated endpoint discovery scans your live services and compares the discovered endpoints against the known inventory. Endpoints found in the scan that are not in the inventory are flagged for review. This catches: old API versions the team forgot about, internal-only endpoints accidentally exposed externally, test/debug endpoints left in production, and shadow APIs deployed by individual teams without central registration.

🔍

Route enumeration from framework metadata

Most web frameworks expose a way to list registered routes: Spring Boot Actuator (/actuator/mappings), Django URL patterns, Rails routes, Express route listing. Scan this metadata automatically and compare against the declared inventory. Every route that appears in framework metadata but not in the inventory is a gap to investigate.

🌐

External attack-surface scanning

Subdomain enumeration (certificate transparency logs, DNS enumeration) finds environments the team forgot are externally accessible. Path fuzzing against known services with a wordlist of common API patterns (/api/v1/, /api/v2/, /api/admin/, /api/internal/, /api/test/) finds undocumented paths. Run this as an attacker would — from outside the network, against production.

📋

Integrate into CI/CD

Run endpoint discovery as a CI/CD pipeline step after every deployment. New endpoints that appear in the running service but are not registered in the inventory fail the pipeline or generate an alert. This prevents undocumented endpoints from reaching production unnoticed. Tools: OWASP ZAP (active scan), Postman/Newman, custom crawlers against OpenAPI-generated specs.

💼 Business takeaway

Ask your security team whether penetration tests and automated scans cover all API versions and subdomains — not just the documented production API. An untested API version is an unsecured one.

← Back MIT 07: API gateway →