2

Today I found a website which generates a fake profile when asked if said profile exists. Example: www.site.com/user/mycoolname doesn't exist yet. But if I put it in the browser for the site I get a fake profile of mycoolname with no picture, a date joined from some time in the past 6 years, and the users two favorite ice cream flavors (ok its not that, but its close).

If I go to www.site.com/flavor/mint-chocolate and change it to flavor/mint-copperfield it returns 'flavor not found', but for users it doesn't.

Does user/randomletters exist after I close my browser, and if so, isn't this a threat to their servers?

[If the answer is no, I'm curious how I can verify it doesn't persist or why it's not a threat that it does, if it's yes I intend to contact their security team.]

4
  • Further info: user/mycoolname can't be logged into even though his join date and favorite team will be the same next time I check the address. If, however, I create an account with the same username and my actual favorite ice creams and a real email address, then when I go user/mycoolname it will have replaced the randomly generated information with mine.
    – Phaidrin
    Apr 11, 2022 at 23:48
  • It's quite possible that there's no persistence, and that profile details are generated on-the-fly in a pseudo random way based on randomletters (a form of procedural generation).
    – TripeHound
    Sep 9, 2022 at 12:43
  • I assume they are generated on-they-fly, but the profile details and the page that presents them does then have persistence.
    – Phaidrin
    Sep 11, 2022 at 10:19
  • How would you tell between "the same details generated on-the-fly each time you visit", and persistence? (I've not explored the site, so there may well be a way of telling, but absent any way, it's as easy – or easier – to generate it on the fly each time).
    – TripeHound
    Sep 11, 2022 at 11:29

1 Answer 1

0

Does user/randomletters exist after I close my browser, and if so, isn't this a threat to their servers?

Probably does. It probably is using a hash table to map any invalid profile to a handful of generated profiles, so when you register the profile, it won't return an error anymore and will return your profile instead.

You can check this by accessing the same generated profile from your computer and from your cellphone. If the profile is the same, it's something like that. If they are different, the site may just be generating profiles on-fly and showing you.

How could this be a threat to their servers? Impossible to tell. It won't create any issue per se, but could be vulnerable to common pitfalls unrelated to generated profiles:

  • Does the generated profiles load generated content controlled by the client (something like <img src='profile.php?id=xxxx'>)? This could lead to resource exhaustion, improper file access, insecure direct object reference...

  • Can you change something on the URL and it reflects on the page (like site.com/user/coolname?q=<script>alert(1)</script>)? This could lead to XSS.

2
  • The profile is consistent across devices. I think I understand that the amount of dates/flavors combos wouldn't be an issue, but I thought that pages for every possible username might be a risk. There is no 'are you a robot' step or click event necessary. If I wrote a script that searched for 5 million strings as users on the website (not opening the pages, just asking if they exist) this website would create 5 million pages. I assumed some upper limit must exist, but it seems you're saying there is no risk of resource exhaustion.
    – Phaidrin
    Apr 12, 2022 at 9:37
  • 1
    It would not create 5 million pages, but only gather details from a pool of pre-generated profiles. Try using your script to download the data and compare: you will find repetitions after a few profiles.
    – ThoriumBR
    Apr 12, 2022 at 9:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .