Content
@
https://opensea.io/collection/dev-21
0 reply
0 recast
2 reactions
welter
@fun
so i hacked tiktok's backend TLDR; a post request wasnt sending through due to some 500 error but i modified the post body so it would be accepted, confirmed by the 200 status i got and also by the confirmation email tiktok sent me saying they're reviewing my application
4 replies
23 recasts
31 reactions
J. Valeska π¦π©π«
@jvaleska.eth
you "hacked" the post request with a method called parameter tampering, yeah so hilarious π€£ π€£
1 reply
3 recasts
5 reactions
welter
@fun
mannn that doesnt sound as cool as "hacking" lol
1 reply
0 recast
4 reactions
J. Valeska π¦π©π«
@jvaleska.eth
hahaha tampering does not sound cool, anyway, this is a real hacking method (I used double quotes cof it is just a basic post request manipulation and anyone is free to send any post request.. this is the client side.. like using a personal script and missing some parameters)
1 reply
0 recast
4 reactions
agusti
@bleu.eth
I feel they make this friction on purpose canβt believe how many times I found stuff broken client side only smh
1 reply
0 recast
1 reaction
J. Valeska π¦π©π«
@jvaleska.eth
on tiktok too? or in general? if tiktok, what are you all building there?
1 reply
0 recast
1 reaction
agusti
@bleu.eth
In general
1 reply
0 recast
1 reaction
J. Valeska π¦π©π«
@jvaleska.eth
ahh ok haha I was thinking..why is everyone on tiktok.. yeah, application side errors are very common now, maybe something with how the requests are managed or just application side errors (imagine tiktok has a loop to check that all checkboxes are checked.. but they removed these 2 ones from the frontend.. but not from the post request.. the loop will reject on validation.. removing these forgotten parameters in the body.. just did the trick, I think this is what is happening there, lazy dev updated it, I guess)
1 reply
0 recast
2 reactions
J. Valeska π¦π©π«
@jvaleska.eth
this is fckn hole in their security.. even a empty list of parameters could pass the validation without signing the contract xD (if I am right)
0 reply
0 recast
1 reaction
