🔥H4ck1ng the Same App for a Month -> $$$$

Critical IDOR & PrivEscs.

Hello, friend! This is mrhashimamin. And I’m back today with a new write-up for you, ma amigo <3.

So, let’s get to it. Today’s story is about some good bugs I found last month while hacking the same app. Let’s call it msg-app.com—a cloud-based communication platform with APIs/SDKs for real-time chat, voice, and video in apps.

My main target was dashboard.msg-app.com. The usual dashboard for controlling user roles, permissions, and tons of other juicy settings perfect for manual testing.

---

#0 New Target? Let's Hack It - 20 Feb

First 3-5 days on a new app? I just learn everything about it:

• Read the docs - see what the app does

• Watch videos - understand why people use it

• Check forums - find real user problems (easy bug ideas!)

• Use the app - with Burp running in background

• Start anywhere - no strict plan, just explore

Okay, let's find some bugs!

---

#1 PrivEsc - P4 ($$$) - 24 Feb

I focused on the channels feature, specifically the report function. Owners can add custom report types for users to flag messages. The free plan has limits:

• 6 custom types + 4 system types

• Or 10 custom types + 0 system types

I added 10 custom types, then sent a request to enable the system types. The backend didn’t enforce the limit, so it worked. Free plan users got extra report types they shouldn’t have.

---

#2 PrivEsc - P3 - $$$ - 3 Mar

The same report function had another PrivEsc flaw. Not all users should be able to report messages, right?

Steps:

1. Created a custom role with only view + chat permissions in channels

2. This role couldn’t report messages (as intended)

3. Sent API requests to report messages/users/channels → 200 OK

Thought I’d get 3 bounties for each report, but they got me xD, Turns out it was one root cause, not separate bugs.

---

#3 IDOR - P1 - $$$$ - 14 Mar

Time to play with the docs! After reading a lot of them, I found a hidden premium feature - message translation. It wasn't in the UI since it's paid-only.

First thought: "If I use this as a free user, maybe P4/P3 at best." But surprise - it was way worse!

The Bug: The request took a message ID, translated it, and leaked:

• The Message

• Sender PII

Tested for IDOR... and it worked perfectly.

Bugcrowd Drama (I hope this happens so much xD):

• Me: Reported as P3 (Based on Bugcrowd VRT)

• Triager: Upgraded to P2

• Customer: "Nah, this is P1" xD

---

Sure, I got a lot of duplicates, infos, and N/As—but that’s bug bounty, you know xD

---

That's the story for today. I hope you find this write-up useful. Thanks, and keep hacking 3>