https://moza369.github.io/tags/access-control/Recent content in Access-Control on MOZAHugoen-usTue, 03 Feb 2026 00:00:00 +0000https://moza369.github.io/writeups/unauth-admin-api-access/Tue, 03 Feb 2026 00:00:00 +0000https://moza369.github.io/writeups/unauth-admin-api-access/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>REACTED</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Improper Authorization + HTTP Verb Tampering</td> </tr> <tr> <td><strong>Severity</strong></td> <td>Critical</td> </tr> <tr> <td><strong>Reports</strong></td> <td>2 related findings</td> </tr> <tr> <td><strong>Status</strong></td> <td>Resolved</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>It started with the Wayback Machine.</p> <p>While mapping a REACTED application, I threw the wildcard scope into the Web Archive CDX API:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">https://web.archive.org/cdx/search/cdx?url=*.example.com&amp;output=text&amp;fl=original&amp;collapse=urlkey </span></span></code></pre></div><p>Among the archived URLs, a few interesting endpoints caught my eye:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">/Dtts3s/winners </span></span><span class="line"><span class="cl">/Dtts3s/valid </span></span><span class="line"><span class="cl">/Dtts3s/list </span></span></code></pre></div><p>These looked like admin panel routes for managing a promotional campaign. I hit them with GET requests — nothing. The frontend redirected or returned empty responses. The UI routes appeared protected.</p>https://moza369.github.io/writeups/access-control-premium-bypass/Fri, 13 Jun 2025 00:00:00 +0000https://moza369.github.io/writeups/access-control-premium-bypass/<h2 id="summary">Summary</h2> <table> <thead> <tr> <th>Detail</th> <th>Value</th> </tr> </thead> <tbody> <tr> <td><strong>Target</strong></td> <td>Roblox</td> </tr> <tr> <td><strong>Weakness</strong></td> <td>Improper Access Control</td> </tr> <tr> <td><strong>Severity</strong></td> <td>Low (adjusted by vendor)</td> </tr> <tr> <td><strong>Status</strong></td> <td>Resolved</td> </tr> <tr> <td><strong>Platform</strong></td> <td>HackerOne</td> </tr> </tbody> </table> <h2 id="the-story">The Story</h2> <p>I was editing one of my server listings on the platform when I intercepted the PATCH request in Burp Suite. Something caught my eye — the request body already contained an <code>imageUrls</code> parameter, sitting there empty alongside other fields:</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-fallback" data-lang="fallback"><span class="line"><span class="cl">data=test&amp;imageUrls=[]&amp;... </span></span></code></pre></div><p>According to the UI, uploading images was <strong>&ldquo;Premium Only&rdquo;</strong> — the frontend showed a clear message: <em>&ldquo;Uploading images is only available to premium servers.&rdquo;</em></p>