API Security
REST and GraphQL — mass assignment, over-fetching and the object that was never yours.
Reading another user's support tickets
Reach an object that was never yours by changing the id that names it.
The invoice with your neighbour's name on it
Reach an object that was never yours by changing the id that names it.
The order history one id away
Reach an object that was never yours by changing the id that names it.
A webhook tester pointed at localhost
Make the server fetch a URL of your choosing, from inside its network.
An image importer aimed inward
Make the server fetch a URL of your choosing, from inside its network.
Deleting a comment you did not write
Reach an object that was never yours by changing the id that names it.
Editing a profile that is not yours
Reach an object that was never yours by changing the id that names it.
The export endpoint that forgot to ask who is asking
Reach an object that was never yours by changing the id that names it.
The link-preview that fetches anything
Make the server fetch a URL of your choosing, from inside its network.
A GUID is not an authorization check
Reach an object that was never yours by changing the id that names it.
Blind SSRF confirmed out of band
Make the server fetch a URL of your choosing, from inside its network.
Bypassing an allowlist with a DNS trick
Make the server fetch a URL of your choosing, from inside its network.
Mass-assigning your way into an admin group
Reach an object that was never yours by changing the id that names it.
Reaching the cloud metadata endpoint
Make the server fetch a URL of your choosing, from inside its network.
The nested resource that skipped its parent's check
Reach an object that was never yours by changing the id that names it.
Chaining two objects into a full account read
Reach an object that was never yours by changing the id that names it.
Gopher-smuggling a request to an internal service
Make the server fetch a URL of your choosing, from inside its network.
Redirect-hopping into a private range
Make the server fetch a URL of your choosing, from inside its network.