Hacking an API endpoint is the web request sibling of SQL injection. It is a place where SQL Injection best practices\u00a0 – parameterization and sanitization of input can be bypassed by directly interacting with a server in JSON or XML (or whatever vernacular your endpoint may spit out)<\/p>\n
This would have interested me also…partner.steamgames.com\/partnercdkeys\/assignkeys\/<\/em><\/p>\n This (and another more ~classic~ SQL injection attack) were discovered by a HackerOne guy who received bounties for his efforts and the full disclosure to the Steam company.<\/p>\n https:\/\/www.zdnet.com\/article\/steam-bug-could-have-given-you-access-to-all-the-cd-keys-of-any-game\/<\/p>\n https:\/\/hackerone.com\/reports\/383127<\/p>\n https:\/\/partner.steamgames.com\/<\/p>\n https:\/\/partner.steampowered.com\/login\/?goto=%2F<\/p>\n","protected":false},"excerpt":{"rendered":" Hacking an API endpoint is the web request sibling of SQL injection. It is a place where SQL Injection best practices\u00a0 – parameterization and sanitization of input can be bypassed by directly interacting with a server in JSON or XML (or whatever vernacular your endpoint may spit out) This would have interested me also…partner.steamgames.com\/partnercdkeys\/assignkeys\/ This […]<\/p>\n","protected":false},"author":20410,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[716936],"tags":[],"class_list":{"0":"post-5889","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-week-11-it-risk","7":"entry"},"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/posts\/5889","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/users\/20410"}],"replies":[{"embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/comments?post=5889"}],"version-history":[{"count":1,"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/posts\/5889\/revisions"}],"predecessor-version":[{"id":5890,"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/posts\/5889\/revisions\/5890"}],"wp:attachment":[{"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/media?parent=5889"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/categories?post=5889"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/community.mis.temple.edu\/mis5211sec001fall2018\/wp-json\/wp\/v2\/tags?post=5889"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}