Welcome to Day 1. I found 1 vulnerability and lost a little bit of money while hacking a target endpoint.
I was doing recon and I came across two interesting functions — Contact Us & Premium Account. The “Contact Us” page allowed users to send files and messages to the company so I sent the request to the intruder tab to send 100+ requests and it worked, this means that there’s a rate-limit issue, there were no restrictions in place, I went ahead and submitted the report, the amazing part is that this company pays $500 for low-severity, so should this report get triaged, I’ll be the half way my bounty target, in day 1, that would be funny but I’m not expecting much from this report if I’m being honest, based on my experience with similar reports. But what do I have to lose, It’s worth reporting, the company will decide the rest :)
The target endpoint had a premium account as I’ve mentioned and it cost 1 euro, so I went on, grabbed my card, let burp run in the background, and kept intercepting those juicy requests but there was a problem… I still had no access to the premium account, I waited 30 minutes as the “success” page suggested, and still nothing and it dawned upon me — I’m on the dev page, which means I should look for the production page for guaranteed success which means I’d have to spend another 1 euro, no problem. I did that but there was another problem, the price on the production site for the premium account is 30 euros… That’s a massive increase, I decided to end it there, I might put the 30 euros account at some point but right now that’s not my focus so tomorrow I’ll be focusing on a new target considering that I’m done with this endpoint, It took me a day’s work, faster than I expected, It usually takes days. Overall, it was a good day, had a lot of fun.
See you tomorrow❤
