I Just Wanted My Resume

There was this random night when a random wave of motivation hit me.

I was like, fuck it, let me start applying for remote cybersecurity jobs.
You know… the ones that actually pay well and shiii.

So I started working on my resume.

Grabbed my PC, opened Google, and searched:

"CV builder free"

Checked a few sites and eventually landed on one that looked pretty cool. It had a resume builder, job search engines, a bunch of other career-related stuff.

I said, aight, let's cook.

Built my CV, everything looked good, and then I tried to download it.

Paywall.

Reallllllly bruuuuuuuh.

I'm literally trying to get employed so I can make money and you're asking me for money to download the CV that's supposed to help me get a job???

realllllyyyy atp ??

Ain't no way I'm paying for that

And that's where the game started

I opened Burp Suite and started capturing the requests.

At some point, I got so deep into the traffic that I completely forgot what I was originally testing

So I quickly reassigned the priority:

Goal: bypass the paywall → get my CV → leave.

First thing I tried was removing the Pro-only features from the resume and attempting the download again.

That's when I noticed something interesting.

The application had an endpoint for exporting the resume:

/api/export/add

And when the download process happened, the response basically gave me a clue about where the generated CV was being stored.

AWS.

Bingo.

Now things started getting interesting.

I already had the export endpoint. The only thing I needed to figure out was:

How does the application actually save the CV to that storage?

So I went back through the Burp proxy history.

While scrolling through the requests, I noticed something I'd completely overlooked earlier.

Every time I changed something in the resume, the application automatically saved it.

Just like Google Docs.

Change something → request gets sent → resume gets updated.

And I was like:

"Damn. Okay. This is the jackpot."

Even with the Pro features, the resume was still being automatically saved.

So now the workflow was basically sitting right in front of me:

Resume ID → export endpoint → generated PDF → download URL.

I sent my resume ID to the endpoint and waited.

Anddddddddd...

YEAAAAAAAAAAAAAA.

It actually worked.

I genuinely didn't expect it to work that easily 😂

I got my CV.

But obviously, I wasn't just going to disappear after getting what I wanted.

I reported the issue to them right after, just in case, and yea replied :)

They also gave me some free usage, which was honestly pretty cool.

But the funniest part?

I actually got hired using that CV :)

Like...

I bypassed the paywall on a CV builder, downloaded the resume, reported the vulnerability, and then ended up getting hired with the exact CV I got from it.

What are the odds?

Anyway, that's the story

Nothing crazy. No RCE. No database dump. No movie-hacker shit.
and developers please be aware of security for GOD sake

see yoo soon :)