3 ms·
Leaks are everywhere. I went to a certain country and needed to register my phone, somehow ended up in a workflow that allowed me to enter any national registra
by someotherperson 5y ago
Leaks are everywhere. I went to a certain country and needed to register my phone, somehow ended up in a workflow that allowed me to enter any national registration number (similar to a social security number) and it would output the person's name, phone number, address and other details for me to confirm that that was me :)
No rate limiting on the endpoint, doesn't require auth, didn't block my VPN, doesn't even set cookies (very privacy conscious devs apparently). I could have mined the entire country's data. Insane.
- cortesoft 5y agoHow do you know it wasn’t rate limited?
- AdamJacobMuller 5y agofor((i=0;i<=99999999999;i++));do curl https://site.com/info.php?id=$i https://site.com/info.php?id=$i > $i.json done
- callalex 5y agoThis is a tangent, but curl has built-in support for “globbing”. For numeric ranges you can just put the range in [brackets] and it handles the rest.
- duskwuff 5y agoHardly matters. If an endpoint is leaking anything as sensitive as national ID + name + address, a determined attacker will have no problem with scraping it slowly or using a network of proxies to avoid rate limits.