The original post: /r/cybersecurity by /u/PriorPuzzleheaded880 on 2024-11-20 13:52:37.

Hi all,

I wanted to share with the community our latest security research. We crawled exposed code for most domains of Fortune 1000 (excl. Meta, Google, Amazon…) and CAC 40 (French largest orgs). It allowed us to discover 30,784 exposed APIs (some were logical to discover, but some for sure not - like 3,945 development APIs and 3,001 staging). We wanted to test them for vulnerabilities, so the main challenge was to generate specs to start scanning. We found some of the API specs that were exposed, but we managed to generate approx 29k specs programmatically. We tackled this by parsing the Abstract Syntax Tree (AST) from the code.

Once we ran scans on 30k exposed APIs with these specs, we found 100k vulnerabilities, 1,830 highs (ex. APIs vulnerable to BOLA, SQL injections etc…) and 1,806 accessible secrets.

You can read more about our methodology and some of the key findings here.