Hacking Happn for learning
So after my last post where I briefly explained how I dumped Tinder’s database, Happn got my attention. Actually It kept popping up in my Facebook feeds and It was their mistake.
I opened an account in Happn to understand how the application works and also to try my luck in getting a date this Saraswati puja. Then as usual I logged into the application via web and logged all the requests in BurpSuite. It didn’t take me long to understand this application provided I had the backend knowledge of Tinder from the last learning.
I sent the interesting requests to the repeater to play with them and further understand the application. What I found was that every request had an important header that is the access token for the particular user. Next I launched my all time favorite API testing tool Insomnia (I don’t use Postman). There I found the endpoints that return my recommendations, my own data, the endpoint to like or reject someone.
Get Polestar’s stories in your inbox
Join Medium for free to get updates from this writer.
Among these, the endpoint that returned my own data was the one I didn’t know I was searching for. Among all the data, the response also had the link to the primary photo of the latest account that have liked me. This is the same case with Tinder as well but Happn have made it easy to trace back to the account from just the photo link.
Every account in Happn have to upload at least one photo of them to use the application. Now the way the photos are saved is under the directory of the user’s unique id and then the unique id of the photo plus extension. This cracked the code. I compared my own photo’s links with my unique id and found out this juicy information.
Now It was just a piece of cake to reverse trace the account I was looking for. Another vulnerable endpoint was the one that returned any user’s public data based on their unique id. So I grabbed the user’s id portion from the link, placed it in the API parameters, sent the request and voila, the account was in front of me. I successfully bypassed the premium feature of Happn and got who liked me without spending an extra coin. I also liked them from the backend and yes It matched. They were indeed the accounts that had liked me.
I created my own API on top of the Happn API to bypass their premium and give everyone full access. Though the work is not done yet, you can find the deployment here and the backend is deployed here. The github repository to understand the application can be found here.
