Free Article Link: Click for free!

One of the biggest mistakes developers make is thinking that if two API endpoints are individually harmless, using them together will also be harmless.

Unfortunately, that isn’t always true.

During one of my recent security assessments on target.com, I came across what initially looked like a simple user search feature inside the company’s Academy platform. At first glance, there wasn’t anything particularly exciting about it. It behaved exactly as I expected a messaging feature to behave.

Or so I thought.

As I spent more time understanding how the application worked, that seemingly harmless feature turned into a chained Broken Access Control vulnerability that allowed a low-privileged user to enumerate platform users and expose sensitive personal information at scale.

This eventually resulted in a $2,000 bounty, but more importantly, it reminded me why understanding how APIs interact is often more valuable than looking at them individually.

Looking Beyond the First Request

When I’m testing an application, I rarely stop after finding a single interesting response.