This is How a Simple IDOR Earned Me a Max Bug Bounty Payout — Transcript

Full transcript

1. 0:00here's the deal there was this
2. 0:01multi-billion dollar Financial giant
3. 0:03with a domain that's been chilling there
4. 0:05since 2012 every hacker out there missed
5. 0:08it I obviously found it messed around
6. 0:09with a little bit and I saw that the
7. 0:10login page that they had on there looked
8. 0:12like nothing special until I dog into
9. 0:14GitHub and Bam I found an API that was
10. 0:16leaking a user's data but then the
11. 0:18hacker one triage kicked it back and
12. 0:20there was like Eh this is kind of a
13. 0:21medium severity because you need to know
14. 0:23the username in order to exploit this
15. 0:25and that is kind of a valid point
16. 0:27because if I didn't have the usernames
17. 0:28it would be a lot harder to Li this data
18. 0:30so I had to roll up my sleeves a little
19. 0:32bit and I had to fire up the good old Ai
20. 0:35and some Automation and let it rip
21. 0:37through thousands of usernames until I
22. 0:39figured out a pattern that leaked almost
23. 0:41every user's data within this website so
24. 0:43in this video I'm going to walk you
25. 0:44through how I turned a medium or
26. 0:46potential medium vulnerability into a
27. 0:48critical one also how I snag the max
28. 0:50Bounty and potentially could have leaked
29. 0:51the data for a bunch of users including
30. 0:53their national ID their phone number
31. 0:55email their address as you name it I
32. 0:57could have probably leaked within this
33. 0:58API so if you want to follow along go to
34. 1:00hacking up. I have a whole Lab set up
35. 1:01for this you look for Ghost API launch
36. 1:03it and we're going to dive right into it
37. 1:05so like I mentioned earlier when we went
38. 1:07to the website the main site was www.
39. 1:10site. thld and it was kind of weird
40. 1:13because it was just a login with a
41. 1:15contact page on it and nothing else I
42. 1:16ripped through the JavaScript nothing
43. 1:18came up I did some Google doing nothing
44. 1:19came up I also tried doing things like
45. 1:21Wayback URL and way more nothing came up
46. 1:23the stuff that dead came up I couldn't
47. 1:25access and it was something that was not
48. 1:26authorized to see it until I went to
49. 1:28GitHub and put the domain into GitHub
50. 1:29search and found this specific API
51. 1:31endpoint which by the way if you want to
52. 1:33see a whole video on how I use GitHub to
53. 1:35find vulnerabilities or actually find
54. 1:37endpoints to hack on and not just lead
55. 1:38credentials drop me a comment saying
56. 1:40GitHub and I'll make some labs and cover
57. 1:42it next but when I found this endpoint
58. 1:44it looked something like this and if you
59. 1:46go to it right away it looks like it's
60. 1:48leaking pii and the reason why this
61. 1:50worked is I'm assuming J Rodriguez 75
62. 1:52was actually just doing some automation
63. 1:54or I don't remember what the repo was
64. 1:55but they were doing something where they
65. 1:57were grabbing information out of their
66. 1:58own user account and they ended up
67. 2:00leaking the URL and when I went to it it
68. 2:02leaked all their private data so I
69. 2:04reported this to hacker 1 and hacker one
70. 2:05came back and was like this is a valid
71. 2:07bug but it's probably medium severity
72. 2:09because you need to know the user's
73. 2:11username in order to leak it and that is
74. 2:13a valid point because if I went into
75. 2:14here and I tried things like admin it
76. 2:17wouldn't work if I tried you know A
77. 2:19Smith for example it didn't want to work
78. 2:20B Smith all I was trying was more
79. 2:23American last names and anything else
80. 2:24not realizing I'm in a Hispanic region
81. 2:26so I'm in South America somewhere then I
82. 2:28tried doing actual integers and going
83. 2:30one two three one and then going all the
84. 2:32way to a thousand doing some things in
85. 2:34the millions thinking maybe somehow
86. 2:36they're mapped out to also an ID user ID
87. 2:38or integer ID that also didn't work then
88. 2:41I realized there's something really cool
89. 2:42about this Dre Rodriguez username and it
90. 2:45looks like it is Jay Rodriguez 75 so I
91. 2:48was like okay let's try 74 76 nothing
92. 2:51worked but then when I remov the ID it
93. 2:54looked like Jay Rodriguez came back and
94. 2:56gave me different email address and
95. 2:57phone numbers and data that was a
96. 2:59complete completely different username
97. 3:00so that made me wonder since I can sign
98. 3:02up for this website the system is
99. 3:04assigning a username to each of these
100. 3:06users and it's doing it base on the
101. 3:08first initial and the last name and if
102. 3:10the first initial plus last name is
103. 3:12actually taken by somebody else then
104. 3:14they're putting a number at the end
105. 3:16which potentially could be the year of
106. 3:18birth so if you're born in 1975 and your
107. 3:20name is Jay Rodriguez it gives you this
108. 3:22username so you have J Rodriguez 75 cool
109. 3:26but the problem here becomes how do I
110. 3:28think of all these different last names
111. 3:30this is where using Ai and some
112. 3:31automation became super super cool and
113. 3:33helped me in a lot of different ways so
114. 3:35I went to chat GPT and I said give me a
115. 3:37list of the top five Hispanic last names
116. 3:40for the sake of this example we're going
117. 3:41to stick to five and it came back and
118. 3:43gave me this list perfect we already
119. 3:45know Rodriguez exists we know Martinez
120. 3:47Hernandez and Lopez could be the other
121. 3:48ones so we go back into here and we try
122. 3:50a Hernandez and it looks like that one
123. 3:53didn't want to work B Hernandez C
124. 3:55Hernandez and so on but then I tried
125. 3:57Lopez so I tried a Lopez and obviously
126. 3:59this one comes back I see B Lopez looks
127. 4:01like this one's also coming back C Lopez
128. 4:03they're all coming back giving me
129. 4:04different data for all these different
130. 4:06users so now we need to find a way to
131. 4:08leak all this user data by just
132. 4:11automating it so we're going to go back
133. 4:12to chat GPT and now we're going to say
134. 4:14hey generate a piece of code that
135. 4:15provides a list of the top 10 popular
136. 4:18Hispanic last names to create a list of
137. 4:19usernames that meets his criteria it's
138. 4:21going to go from A to Z so 26 entries
139. 4:23per last name then it's going to do the
140. 4:25same thing and add the numbers from 60
141. 4:26to 99 so it covers everything from 9
142. 4:291960 to 1999 and then we're going to say
143. 4:32hey I also want you to make a piece of
144. 4:34this at the end that makes a get request
145. 4:36to each of these usernames and then
146. 4:37tells us which ones come back as a 200
147. 4:39so we're going to copy this exploit and
148. 4:40then just run it and Bam we have a bunch
149. 4:43of users that are coming back we can
150. 4:44copy this and go into our browser and
151. 4:46see which ones come valid I only did a
152. 4:48couple of these just because there is
153. 4:50pii in here and I don't want to like
154. 4:51access every user this is why I had to
155. 4:53do this specifically because now it's
156. 4:55just printing out all the usernames that
157. 4:56are valid and I don't have to open it up
158. 4:58I can just copy this give it to H1 Char
159. 5:00and say hey it looks like this is the
160. 5:01logic of the usernames and here's a list
161. 5:04of all the users that I found but I did
162. 5:05not access every single one of them so
163. 5:07that didn't leak every user's pii this
164. 5:09way so there's a couple things here that
165. 5:10we need to think about is did I need AI
166. 5:12to do this probably not I could probably
167. 5:14code something in bash or python that
168. 5:16did this I could have probably found the
169. 5:17usernames by doing some Google searches
170. 5:19but honestly having access to these
171. 5:20models and having access to chat gp2 or
172. 5:22cloud makes it super easy not only I can
173. 5:24get it to make these usernames for me I
174. 5:26can also just have it automate for me
175. 5:28copy it and then throw it in there and
176. 5:30have it just give me all the entries
177. 5:31that are valid just like I showed
178. 5:33earlier so that is a wrap for this one
179. 5:35and honestly the craziest part about
180. 5:37this is that this domain wasn't buried
181. 5:39under some complex subdomain structure
182. 5:41or hidden behind some obscure RoR X
183. 5:43we're talking about a Brand's name plus
184. 5:45some specific country TLD hiding in
185. 5:48plain sight plus this program has been
186. 5:50public for over 3 years with hundreds of
187. 5:52hackers taking a shot at it and I just
188. 5:54found this vulnerability not too long
189. 5:56ago no fancy rot forcing no weird
190. 5:58techniques it all just came down to
191. 6:00connecting the dots between Recon GitHub
192. 6:02and a bit of creative automation so the
193. 6:04next time someone tells you all the good
194. 6:06bugs are dried up there's no low hanging
195. 6:07frood I can't find a bug in a public
196. 6:09program remember this bug there are
197. 6:11still critical vulnerabilities sitting
198. 6:13on obvious domains that everyone is
199. 6:15overlooking the Gold Rush isn't over you
200. 6:17just need to look at the same targets
201. 6:19with a different approach and get a bit
202. 6:21of creativity in you if you got value
203. 6:23from this video do me a favor hit that
204. 6:24like button drop me a comment especially
205. 6:26if you want to see more API hacking
206. 6:28techniques and I will catch you all in
207. 6:29the this video peace
208. 6:35[Music]