Excessive Data Exposure

APIs that return passwordHash and internal flags — filter responses. Lab :8816.

Excessive Data Exposure• Audio Walkthrough

00:00/02:16

Visual · api_excessive_exposure

Return least data. Original Cyberlium.

If the client does not need it, do not send it.

Excessive data exposure returns full objects and relies on the UI to hide fields. Attackers call the API directly. Shape public DTOs.

1. Symptoms

/users/me returns passwordHash, reset tokens, internal flags.

Mobile apps often reveal more than web UIs.

Command guide

Try these commands — Symptoms

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

TLS inspection — https://www.openssl.org/docs/manmaster/man1/openssl-s_client/ Data exposure — https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install jq
sudo apt install openssl

macOS:

Command — copy this

brew install jq

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install jq
choco install openssl

═══ LINUX / macOS ═══

Command — copy this

curl -sS -H "Authorization: Bearer userA" http://127.0.0.1:8816/users/1 | jq 'keys'
echo | openssl s_client -connect 127.0.0.1:443 -servername localhost 2>/dev/null | openssl x509 -noout -subject -dates 2>/dev/null || echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -subject -issuer | head -2

Primary tools to practice this lesson: curl, jq, openssl. Reference sites: TLS inspection (https://www.openssl.org/docs/manmaster/man1/openssl-s_client/); Data exposure (https://owasp.org/API-Security/editions/2023/en/0xa3-broken-object-property-level-authorization/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.