Financial InstitutionAPIWeb
API recon (BOLA) → cash-out
An attacker enumerates another customer's records over the API, then moves money from the same session. Nemesis links the blocked reconnaissance to the cash-out and declines it.
- Attack
- Probe /api/profile for another customer, then transfer ₦850k.
- Nemesis defense
- The blocked probe flags the actor; Omniguard's cross-signal rule declines the follow-up transfer (recon → cash-out).
- Modelled on
- Recon-then-fraud: API BOLA / enumeration probing that precedes account-takeover cash-outs.
Request — review or edit the fields, then run it
Recon step runs first: GET /api/profile?id=3 — on the protected app this is blocked and flags the actor.
Request that will be sent
POST /api/transfer
Content-Type: application/json
{
"dest": "0244553311",
"amount": 850000
}