Bug Hunting #1

this will be my first Medium post.

i was pentesting an application for a coffee shop.

it was going well, i came across the first vulnerability which was an OTP leak when you sign up with your number. ( OTP leak means that when the application sends you an authentication code/one time password to confirm that its your number )

you can see my request on the left, and on the right is the response i received from the server. it gave me the OTP in plaintext.

when i saw that OTP leak, i know there will be more so i kept looking.

then i found another one. there was no server side validation to make changes or retrieve data. ( server side validation is a must so the server makes checks to see if there was any modification from the user rather than the server ) and also was able to change the role of the user.

there was no authentication as well, meaning if the cookies/token were deleted, it still retrieves the data and make changes to them.

authentication is important to know what the user can and cannot access. for this example looking at other user details.

lastly user profile.

i saw that it was UUID ( unique user identifier ) and i tried manipulating the UUID or to try to enumerate them and nothing showed. i almost gave up.

but i was thinking…

what if i delete my UUID???

i did and all the users showed up.

with that i can make changes to their profile and see their personal data they added to the application. like emails , phone numbers , what and where they ordered from.

thank you for reading.

see you in the next one.