
At this point, I focused on testing the get_image.php endpoint with various user IDs I had at hand. To my surprise, it worked flawlessly, allowing me to view any user's profile picture by simply providing their user ID—no authentication required. This lack of security was disappointing, considering how sensitive such endpoints should be. While my intentions weren’t malicious, it was clear this was a significant flaw. I imagine the query behind the scenes looked something like this:
"SELECT avatar FROM table_name WHERE userid = 'user_id';"
The interesting part was how our user IDs were constructed. They seemed to be a combination of our first and last names concatenated with a period (.) in between, which was likely generated during registration. For example, a user named David Jamiel would have a user ID like david.jamiel. It’s plausible that during registration, the system stored these names in variables like $firstname and $lastname and then combined them into a new variable, $combined, as follows:
$combined = $firstname . '.' . $lastname;
This combined variable might then be inserted into a database column, such as userid. While this is just a hypothesis and I couldn’t confirm the actual database schema, the system’s behavior strongly suggested this approach. If I were building a similar system, this is how I’d likely design it for simplicity—though I’d certainly include safeguards to prevent unauthorized access.
This revelation underscored a broader lesson: understanding the possible structure of a target system can make testing and flaw discovery significantly easier. When approaching such systems, it helps to create a theory of how they work. To take it a step further, building a mockup version of the system to test your theories can yield even greater insights. Although it’s time-consuming, the effort often pays off in the long run.
By now, I was fully immersed in uncovering flaws. Each discovery fueled my curiosity and determination to dig deeper. The fact that every step yielded tangible results only made the process more fascinating and rewarding.
Powered by Froala Editor
1 Comment(s)
Subscribe to our Newsletter
Subscribe to receive news, offers, and updates directly in your inbox.
Bro you\'re good, you\'re sounding like Mr Robot. I love the way the means was explained consistently and concisely with flow