Intermediate LevelREST APIs & Web Services
What are Shadow APIs and Zombie APIs, and how do you discover un-documented endpoints?
❓ Interview Prompt: Explain Shadow APIs (third-party/untracked endpoints), Zombie APIs (deprecated un-decommissioned endpoints), API discovery tools, and security auditing.
Un-managed API endpoints represent major enterprise security attack surfaces:
•
Shadow APIs: Endpoints built by developers or third-party services that bypass security reviews and OpenAPI documentation.
•
Zombie APIs: Old version endpoints ('/v1/users') left active in production after new versions launch without security patches.
•
Discovery & Remediation: Use automated eBPF traffic analysis tools (Salt Security, Noname Security) to discover un-documented endpoints across cloud network traffic.
Code Implementation Example
bash
# Example eBPF API discovery agent inspecting network interface traffic:
sudo api-discovery-agent --interface=eth0 --output-openapi=discovered-spec.json💡Using eBPF traffic monitoring agents to discover undocumented Shadow APIs.
🎯 Interview Key Takeaway
Audit network traffic using eBPF tools to discover Shadow and Zombie APIs and enforce security policies across all endpoints.
#Shadow API#Security#eBPF#Intermediate
Back to all REST APIs & Web Services Questions→