Endpoint Analysis Flashcards
In which situation is performing reverse engineering necessary?
When you don’t have an API documentation or if it isn’t available for you. Then you’ll have to create your own collection of endpoints.
When reverse engineering an api, how should you use the app?
I should use the app as intended, but in a meticulously manner to capture every functionality detail and make a better map of the attack surface.
Which flag must be added to improve the api swagger documentation created by the mitmproxy2swagger command?
–examples
True or false: Although the documentation created is useful, you won’t be able to find any vulnerabilities yet
False. It’s possible to find some vulnerabilities, like an information disclosure in a response.
Why is it important to look for the “overview” section of an API documentation?
The overview section contains high-level information about how to connect to the api and how to use it. It also could contain information about authentication and rate-limit.
Why it’s important to review an API documentation?
To look for functionalities and actions that you can take. To note request’s requirements such as form of authentication, parameters, path variables, headers and body.
When excessive data exposure occurs?
When an API sends a full data object as a response, typically to be filtered by the client.
In the EDE, the amount of data sent by the API matters?
Although the response size can indicate this vulnerability, it’s not about the amount of data, it’s more about the sensitivity of the sent data.
What does a response that has an EDE usually contain?
More information than it was requested and sensitive data that could be leveraged into a more complex attack.
