How I logged into user accounts with no information

Hello Everyone,

This was one of the easiest bugs I found. Unfortunately this website did not have a bug bounty program so in place an email was sent to them.

Background

The website, we will call simply website.com is a site I personally use, I had signed up for text alerts and the morning of, I had gotten a text mentioning offers and to login to my account to check it out with a link provided. I had recieved messages in the past from them and they all looked similar to what is below.

Your offers from website.com are ready: website.com/d/123aB

The Bug

For once I decided to click it, as I knew this was their official number, I figured no harm and checking. But when I went to the link I noticed I was instantly brought to the offers under my profile tab, I had always went to the website from my desktop not my phone. But sure enough when I clicked on the Account tab all of my info was right there.

Dramatic recreation

To verify this, I followed the link on my laptop in an icognito tab and noticed I was logged in instantly once again. This is when I realized if I can just change the ending of the path, I could login to whoevers account. I quickly fired up burp and launced the Intruder

I decided to just try modifying the two letters on the end to start and after a short amount of time I got the url website.com/d/123e, I then copied the URL and pasted it in an icognito browser and BINGO! I was in somebody elses account, now I could modify their info as well as see name, DoB, email, phone, and interests they set. I was able to gather all of this without even knowing the users ID.

Get Jaeden Samia’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Before some of you might mention it could be a one-time or time based login, unfortunately I was reviewing my messages from them and noticed they had sent the same URL but over a month prior to this discovery.

I then found an email to reach support and wrote a report explaining the findings, the dangers and ways to patch.

Update: They are working on a patch and I was rewarded a 5 year membership for reporting it!

Thanks for reading!