#recon
-
No Login Required: Breaking Down NumberBook's Caller-ID API
NumberBook asks for your entire contact list, then answers reverse phone lookups through a backend that has no authentication, no rate limiting, and 'encrypts' its responses with a key that ships inside the app itself.
-
From a Google Search Result to a Live Cloud Key: Inside the StoryGo App's Backend
A random IP in a Google result led to the Alibaba-Cloud backend of a reading app — a self-hosted GitLab/ZenTao/InfluxDB box, and a long-term Alibaba Cloud AccessKey hardcoded into the APK that a live proxy capture proved is still valid.
-
A Public sitemap.xml Isn't a Vulnerability, But What It Lists Might Be
A sitemap.xml disclosure report got closed as Informative, correctly, sitemap.xml is meant to be public. But the report also found a query-parameter trick that paginated through listed entries, including ones that weren't linked anywhere else. A look at where the line actually sits.