Hacking An Online Casino // Bug Bounty Example

### Overview In this walkthrough, the speaker demonstrates how they uncovered critical vulnerabilities in a major European online casino's lottery system. Because non-disclosure agreements and private bug bounty programs often prevent recording live targets, the speaker collaborated with Adam Langley to recreate the scenario as a Capture The Flag (CTF) challenge hosted on hackinghub.io. The demonstration illustrates that encountering an application with only a login prompt and no visible registration does not mean security testing has reached a dead end.

### Key Topics - Overcoming restricted target interfaces with no apparent sign-up option. - Endpoint discovery and API fuzzing with tools like ffuf and curl. - Exploiting verbose API error messages that reveal required request parameters. - Bypassing account verification workflows using exposed user tokens. - Privilege escalation via leaked user enumerations and password brute-forcing to reach an unrestricted file upload.

### Technical Details The attack began on a lottery application presenting only a login interface and a password reset link. Reviewing client-side JavaScript revealed initial authentication routes under the path `/api/v1/auth`.

1. **Endpoint Discovery & Parameter Identification:** Using `ffuf` with custom wordlists (referencing lists such as SecLists or Assetnote), the speaker discovered an unadvertised endpoint at `/api/v1/auth/new`. A `GET` request returned a `405 Method Not Allowed`, indicating that different HTTP methods were expected. Sending a `POST` request revealed verbose error responses specifying missing parameter fields, such as `username`, `email`, `password`, and `password2`. Supplying these fields successfully created an account.

2. **Manual Account Verification:** Logging into the newly registered account showed a status of "awaiting verification." Without receiving a verification email, the speaker inspected background traffic and identified a call to `/api/v1/users/me`. This response exposed the user ID and a `verification_token`. Authenticated fuzzing using the session cookie uncovered an endpoint at `/api/v1/verify`. Submitting a `POST` request with the required `verification_token` and `user_id` verified the account.

3. **Privilege Escalation and Admin Takeover:** Once verified, the application granted access to an internal interface leaking a list of all registered lottery usernames and identifying administrative accounts. By capturing the login request in Burp Suite and brute-forcing passwords (e.g., using lists like `rockyou.txt`), the speaker compromised an administrative account. Administrative access unlocked an unrestricted file upload feature, which allowed an attacker to upload a web shell and achieve remote execution on the target system.

### Takeaways Security researchers should not abandon an assessment simply because there is no obvious public registration link. Hidden API endpoints, verbose error messages, and unauthenticated registration functions often leave paths to obtain an initial low-privileged session. Once authenticated, mapping secondary API routes and identifying information disclosure flaws can quickly escalate access to administrative compromise and full system control.