hunt-shadow-api

OWASP API9 — Improper Inventory Management (Shadow / Zombie APIs)

As an API evolves, old versions and internal/staging routes routinely stay reachable without receiving the same security fixes as the current version — because nobody tracks that they still exist. The bug is rarely in one endpoint; it's in the delta between what an old version enforces and what the current version enforces on the same operation.

When to use

Trigger when:

• Versioned paths are visible (/v1/, /v2/, /api/2023-01-01/) or Accept/X-API-Version headers are in play.
• A changelog, release notes, or deprecation notice references removed/old API behavior.
• A mobile APK/IPA (via apk-redteam-pipeline / ios-redteam-pipeline) hardcodes endpoints that look like an older backend version than the current web app calls.
• Multiple OpenAPI/Swagger specs are discoverable, or info.version in one spec implies others exist.