Sometimes the vulnerability finds you
So this unexpected thing happened yesterday (idk tho ) wtv
.png)
I was doomscrolling through TikTok when I saw a vibe coder flexing a platform he had just built. (And nah, before y'all start... I don't hate vibe coders, eventually, I'm one of 'em too he he)
then i thought like "Hmm... aight, what you got?"
I was bored anyway, so I opened it
and honestly?
the site was actually cool. It wasn't drowning in AI-generated slop, the UI was clean relatively... almost as clean as me :) u feel me lol
but you guys already know how this story goes.
I casually opened Burp Suite, turned on Burp's browser, let the crawler do its thing...
...and boom
we were officially in the mud mtsm
.png)
so like any normal user (totally normal behavior okay :) ), I clicked around every corner of the website first
Then I checked Burp
hmmm interesting
A few juicy API endpoints showed up.
bookingreviewsgallery
The backend was hosted on Render.
but it has unstable cors issue which is not much of our problem here
I started poking each API endpoint directly one by one
.png)
.png)
.png)
and... Damn
That got depressing real fast
Payment screenshot URLs
User phone numbers
Other sensitive data
Just sitting there... in the wild.
No authentication
No API key
No token
Nothing
like... bro... at least ask me who I am first. 😭
then I checked the supported HTTP methods
And guess what?
OPTIONS was basically telling me:
"Yeah bro... go ahead"
now I knew the server accepted write operations
the only missing piece was figuring out the required request format
.png)
I opened the page source.
A little JavaScript later...Everything I needed was right there.
Love it when developers leave me documentation
.png)
now comes the fun part.
lets start with the reviews endpoint
the endpoint expected something like this:
{
"name":"mr goofy :)",
"role":"yapper",
"comment":"well well well, i was here yk just to let u know he he he",
"photoUrl":"",
"rating":0 // be savage hehe
}
aight so lets actually send the request
role,name and comment is a required keys
.png)
yup just like that we created a review lets check on the server if it is there
I sent the request And...It worked, Just like that A brand new review was created
.png)
Then I tried deleting it
Worked. Then I realized... I could delete every review. Then I checked the gallery
.png)
Same story, Any image Delete and Gone
Yeah...
that's not exactly what you'd call "production-ready"
.png)
Of course, I reported everything responsibly to the owner
Because breaking stuff is fun...Helping people fix it is cooler u feel me :)
also was not saying this is a damn tragic hack or something i just wanna learn how to write a blog and shii along the way
If you're building with AI, that's completely fine.
Seriously.
Tiny message for the devs/vibecoders
Just don't stop at "Build me a website"
At least ask your AI something like:
"Mitigate OWASP Top 10 vulnerabilities."
"Secure every API endpoint."
"Implement proper authentication and authorization."
Will it make your app perfectly secure?
Absolutely not
Will it eliminate a bunch of trivial vulnerabilities?
Definitely yes
Anyway...that's today's adventure
There are still plenty of weird websites and questionable APIs waiting to be explored.
We'll probably stumble into more cursed bugs together.
Until next time...
Stay curious
Hack responsibly u know what i mean :)