New Feature: Detect Sensitive Data in URLs with Akto

Introduction

In API security testing, sensitive data types can range from personal identifiers to confidential information that may be embedded within URLs in the form of strings or integers. It is crucial to identify these data types to prevent potential data leakage points.

Akto now simplifies this process by intelligently detecting sensitive data types in URLs in an automated way from our pre-existing repository of regular expressions so that your development teams can instantly resolve the vulnerabilities.

Importance of detecting sensitive data in URLs

In 2018, Marriott's Starwood guest reservation database was compromised, potentially exposing the personal information of approximately 500 million guests. One of the vulnerabilities exploited in this breach was related to sensitive data exposure through URLs.

When guests booked reservations through the Starwood reservation system, the confirmation email sent by Marriott contained a URL to manage their booking. This URL included the guest's reservation number and other sensitive information in the query parameters.

Attackers accessed and exploited this vulnerability by manipulating the URL parameters, accessing other guests' reservation details without proper authentication. This allowed unauthorized access to sensitive personal information, including names, addresses, passport numbers, email addresses, and payment card details.

The breach remained undetected for years, and the exposed data was potentially accessible to malicious actors, posing a significant risk to the affected individuals' privacy and security.

You can read more about the incident here.

To ensure such vulnerabilities are detected well in time, Akto’s new feature detects such sensitive information as you upload your traffic on to the dashboard in an automated way. Let’s dig in to see how!

Automated Sensitive Data Detection in URLs with Akto

Akto has 100+ regular expressions stored as Sensitive Data and can clock vulnerabilities in URLs the instant you connect to your traffic.

For example, an API endpoint with the URL v2/phone_number/+1-202-555-0175 would be immediately flagged as it reveals a user’s personal information.

Let’s see how Akto detects sensitive data in URLs:

For that, you’d first need to connect to your traffic data. There are many ways to connect your traffic data to Akto, check out our docs to learn how.

If you use a method that connects to your traffic in CI/CD, then your API collections will immediately appear on your Akto dashboard. Alternatively, you can create a custom collection.

In this example, we’re going to connect to traffic data by uploading a HAR file. So, you will first need to create an API collection.

Then follow the steps below: