Table of Contents
- Curiosity Pays Better Than Surveys
- The Simplest Question
- Sometimes the Simplest Payload Is No Payload
- The Leaderboard
- Time to Stop
- Round Two
- Déjà Vu
- Takeaways
How a single API request turned me into my apartment's #1 resident.
I had just moved into a new apartment.
Like most modern apartment communities, they had an online resident portal. Residents could post photos, comment on events, answer surveys, and earn points for participating.
Those points weren't just for bragging rights.
Once you earned enough, you could redeem them for gift cards. Amazon, Uber Eats, Starbucks, and a handful of other popular retailers.
It was actually a pretty nice incentive.
While everyone else was figuring out where to put their couch, I was doing what I usually do.
Opening Burp Suite.
Curiosity Pays Better Than Surveys #
I wasn't looking for vulnerabilities.
I simply wanted to understand how the application worked.
Every action generated an API request.
Leave a comment?
More points.
Like someone's post?
More points.
Complete a survey?
Even more points.
As I worked my way through the API, one request immediately caught my attention.
Happy Birthday!
+1,000 points
Not because it awarded points.
Because it made me wonder...
How does the server know it's actually my birthday?
The Simplest Question #
I replayed the request.
Another 1,000 points.
I replayed it again.
Another 1,000.
Again.
Another 1,000.
At first I assumed there had to be some validation happening somewhere else.
Maybe the balance wouldn't actually update.
Maybe it was only cosmetic.
Maybe there was some nightly reconciliation process.
There wasn't.
The server happily awarded birthday points every single time the request was replayed.
Sometimes the Simplest Payload Is No Payload #
Rather than clicking Replay over and over, I sent the request to Burp Intruder.
No payload list.
No fuzzing.
Just the exact same request repeated automatically.
Sometimes the simplest payload is no payload at all.
I let it run for about two minutes before stopping it.
That was more than enough to demonstrate the issue.
I refreshed the page...
...and immediately started laughing.
The Leaderboard #
The platform had a public leaderboard.
Residents who had been actively participating for months were sitting somewhere around 30,000 to 40,000 points.
Then there was me.
The new resident.
4,000,000 points.
Right at the top.
With my profile picture.
There wasn't anything subtle about it.
Anyone browsing the community could see this random new guy who had somehow earned more points than everyone else combined.
I can only imagine what my neighbors were thinking.
"Who is this guy?"
"Did he complete every survey ever created?"
Time to Stop #
I had already demonstrated the impact.
There was no reason to continue.
I didn't redeem any rewards.
Instead, I documented everything, contacted the vendor responsible for the platform, and explained that the birthday reward could be claimed an unlimited number of times because the backend never enforced the obvious business rule.
A birthday should only happen once a year.
The server never checked.
To their credit, they responded quickly, fixed the issue, and even sent me a gift card as a thank-you.
I figured that was the end of the story.
It wasn't.
Round Two #
A little while later I received another promotional email.
Earn 2,500 bonus points for completing this activity.
The birthday issue had already been fixed.
But promotions like these always make me curious.
This time I wasn't looking for missing validation.
I was looking for a race condition.
I sent the request to Turbo Intruder and fired a burst of concurrent requests.
A few moments later...
My balance had increased by exactly 10,000 points.
The promotion had been redeemed multiple times before the backend realized it should only happen once.
Different bug.
Same reward system.
Déjà Vu #
I reported the second issue.
The vendor fixed it.
Once again, they thanked me with another gift card.
They didn't even have a bug bounty program.
They simply appreciated someone helping improve the security of their platform.
Honestly, that's one of the things I enjoy most about responsible disclosure.
Sometimes the best rewards aren't part of an official program.
Takeaways #
One of the biggest misconceptions about bug hunting is that every interesting vulnerability has to involve complex exploitation.
Sometimes the highest-impact bugs come from asking embarrassingly simple questions.
What happens if I do it twice?
Reward systems are built on trust.
Birthdays.
Coupons.
Referral bonuses.
Daily rewards.
Limited-time promotions.
Leaderboards.
Behind every one of those features is a business rule that the server must enforce.
If the backend trusts the client to follow those rules, eventually someone will discover that the rules aren't really rules at all.
They're just suggestions.
And sometimes...
Those suggestions put the new guy at the top of the leaderboard with four million points.