skills.rest
riandeoliveira
riandeoliveiraCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

exploiting-excessive-data-exposure-in-api

Detect excessive data exposure in REST and GraphQL API responses.

Updated Jan 29, 2024
Search Tags:#api-security#security-testing#owasp-api3#response-validation#excessive-data-exposure#pii-leakage#graphql-overfetching
One-click install
npx skills add https://github.com/riandeoliveira/aspnet-template --skill exploiting-excessive-data-exposure-in-api-riandeoliveira
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: exploiting-excessive-data-exposure-in-api
Source: https://github.com/riandeoliveira/aspnet-template/tree/main/.claude/skills/exploiting-excessive-data-exposure-in-api
Command: npx skills add https://github.com/riandeoliveira/aspnet-template --skill exploiting-excessive-data-exposure-in-api-riandeoliveira

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, json, re, argparse, datetime, and includes scripts (resource) and references (resource) components.

What problem does it solve?

It helps you detect when an API returns sensitive or unnecessary fields that the frontend does not display, exposing PII, internal identifiers, or debug data to anyone who can intercept responses.

Core Features & Use Cases

  • Response schema discovery: Compare documented fields versus actual response payloads to identify excess properties returned by the server.
  • Sensitive pattern detection: Scan response bodies for leaked secrets, tokens, credentials, PII formats (email/phone/SSN), internal IPs, and other high-risk values.
  • UI vs API field comparison: Estimate what the UI shows versus what the API transmits to pinpoint data exposure that client-side filtering can’t protect.
  • Role and endpoint coverage: Test user/admin privilege differences and focus on endpoints that embed full user objects in nested responses.

Quick Start

Run the provided agent script against a target endpoint URL using an authorized bearer token to produce a JSON report of sensitive fields detected in the response.

Frequently Asked Questions about exploiting-excessive-data-exposure-in-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect excessive data exposure in API responses?▼

Detect excessive data exposure by intercepting API responses, recursively enumerating JSON fields, and matching sensitive-value patterns to identify hidden PII returned beyond client UI expectations.

What is OWASP API3:2023 excessive data exposure?▼

OWASP API3:2023 excessive data exposure occurs when APIs return sensitive fields like PII or internal identifiers that the frontend does not display, relying on client-side filtering instead of server-side masking.

How do I test GraphQL over-fetching for PII leakage?▼

Test GraphQL over-fetching by requesting nested user objects and paginated responses, then scanning the returned JSON payloads for leaked emails, phone numbers, or internal IPs not required by the client.

Can I compare documented API schema fields against actual response payloads?▼

Yes, you can compare documented fields versus actual response payloads to estimate what the UI shows versus what the API transmits, pinpointing excess properties and sensitive data exposure.

Does this approach detect role-dependent field exposure in REST APIs?▼

Yes, it detects role-dependent field exposure by testing user and admin privilege differences across REST endpoints, identifying sensitive fields leaked in nested objects based on authorization levels.

Related Skills

Explore More Legal & Compliance Skills→
riandeoliveirariandeoliveira

conducting-api-security-testing

Test REST and GraphQL APIs for OWASP Top 10 vulnerabilities.

Community
Advanced
apisec-incapisec-inc
18

openapi-hardener

Enforce strict validation rules on OpenAPI, JSON Schema, Zod, Joi, and Pydantic schemas.

Official
Advanced
aegnticaegntic
4

api-tester

Test and debug REST and GraphQL APIs with curl and httpie.

Community
Intermediate
EntroVyxEntroVyx
3

recon-bakeries

Probe bakery e-commerce sites for API misconfigurations and data leakage.

Community
Intermediate