Securi-Tay 2020: Saving user data one company at a time - Hacking with zseano

### Overview In this Securi-Tay 2020 talk, full-time bug bounty researcher Sean (known online as zseano) presents his methodology for securing user data across major commercial web applications. Eschewing the conventional focus on extensive external reconnaissance and mass subdomain enumeration, Sean explains how he directs his efforts directly toward core production applications, using platforms exactly as intended to identify fundamental logical flaws—predominantly Insecure Direct Object References (IDORs).

### Key Topics - **Targeting Main Web Applications:** Rather than hunting ephemeral subdomains, focusing deeply on primary applications used by thousands of consumers. Sean highlights that larger organizations frequently maintain multiple localized codebases (e.g., US vs. China deployments) and localized mobile endpoints that introduce distinct feature sets and vulnerabilities. - **Depth Over Breadth:** Sticking with a single program for extended periods (weeks or months) to understand developer habits, patch behaviors, parameter naming conventions, and hidden features. - **JavaScript and Archived Endpoint Analysis:** Extracting deprecated endpoints, developer notes, API patterns, and parameters from client-side JavaScript files and historical `robots.txt` snapshots via the Wayback Machine. - **The IDOR Epidemic:** Emphasizing that while Cross-Site Scripting (XSS) often dominates industry discussion, IDOR vulnerabilities are pervasive across production systems, allowing systematic access to sensitive personal data. - **Defense in Depth and Internal Testing:** Advocating that organizations prioritize internal developer training, QA security testing, and internal hackathons so that bug bounty programs act as a supplementary defense rather than an outsourced substitute for baseline security.

### Technical Details - **Airline Check-in IDORs:** After booking a flight and checking in to test authenticated workflows, Sean observed background API requests querying flight details via JSON using only a six-character booking reference without proper surname or session validation. Testing against sample reference codes found in public promotional materials yielded live test data, and deeper endpoint testing using custom wordlists built from observed parameter patterns uncovered seven critical IDOR bugs. - **Career Platform Data Exposure:** On a third-party careers portal used by Fortune 500 enterprises, an account profile export feature sent a JSON POST request containing `candidate_id: 247830`. Incrementing or substituting this integer allowed unauthenticated enumeration of candidate records (names, CVs, skills) across over 240,000 applicants, alongside endpoints permitting password changes and profile modifications. - **Testing Techniques for IDORs:** - *Parameter Injection:* Appending ID parameters (such as `id=1` or `admin=true`) into JSON payloads that omit identifiers by default. - *Mobile Application Traffic:* Intercepting mobile application traffic using Burp Suite proxy configurations (and handling SSL pinning) to expose simplified REST/JSON endpoints that frequently lack authorization checks. - *Handling Obscured Identifiers:* Bypassing base64-encoded or GUID/UUID identifiers by locating where IDs are leaked (e.g., CDN image file paths, page source) or testing raw integers directly in place of complex hashes. - *Recon via Wayback Machine & GitHub:* Scraping years of `robots.txt` changes to expand endpoint coverage from 100 to over 7,000 targets, and auditing GitHub repositories for exposed API tokens and plaintext credentials.

### Takeaways Sean stresses that finding severe bugs often requires simply analyzing how applications handle identifiers rather than relying on sophisticated exploitation tooling. He urges bug hunters to maintain organized notes on parameter patterns and enjoy the problem-solving process. For organizations, he warns against viewing bug bounties as an automated fix-all, advising companies to identify root causes and train developers internally before exposing platforms to external researchers.