Issue 208: Urlscan.io leaks sensitive data, Dropbox phishing attack, contract test for microservices
Brief
This week, we have news of two API-related data breaches: the first in Urlscan. io API, which was found to be leaking sensitive URLs and data, and the second a phishing attack on Dropbox, where private GitHub repositories were copied. We also have an article on the importance of contract testing for microservices, and finally, another contribution from Dana Epp on five mistakes that hackers make when attacking APIs.
Breach: Urlscan.io leaking sensitive URLs and data
First up is a report from PortSwigger on the recent vulnerability in the Urlscan. io website , which unwittingly leaked URLs and other sensitive data, including emails. Urlscan. io is a popular tool in the industry for automated scans on websites to assess if they contain malicious content. The Urlscan.