Hacker News new | ask | show | jobs
by josephwegner 3236 days ago
Somehow I managed to land my first programming job in the most stereotypical means possible.

I had connected with this young startup through my budding network. I was young, they were young, and we were both involved in TeensInTech (formerly a community of teens interested in startups). I had done a couple rounds of UI/UX feedback for them, that they had requested via TinT. The company made a password & bookmark manager (not one of the ones that is available today. They want out of business).

One day they launched a major website overhaul. Excitedly, I went to their website to play around with it. Purely by chance, I fat fingered my password as I was entering it in. The login failed, obviously, but I was surprised to see that the password input on the failed login page was now filled with a mysterious looking hash. My assumption was that was my hashed password.

This spurred me to open my dev tools and look at the network requests to figure out what was going on. It turned out that their new website was powered by a new API which hadn't really been hardened at all. Within about an hour I was able to find an endpoint that allowed me to enumerate all of the users on their site, and another endpoint that returned a user's stored authentication details (hashed passwords, full usernames & URLs). I wrote a few lines of javascript that looped through all of the users, and fearfully received a dump of their entire credentials table. Obviously that is bad bad bad.

I sent them an email explaining the issue. Their website was promptly taken offline, hardened, and then I received a job offer.

tl;dr; I hacked my first employer's website, and they offered me a job for it.

2 comments

Are you saying that the password field returned a password hash of the correct password when you mistyped it?

That's extremely bizarre.

The specifics of it escape me at this point. My guess is that it was a hash of the incorrect password. That wasn't necessarily the security risk, but it did spark my curiosity that led to the rest.
Seems like some misused form framework. They were potentially striving for Facebook-like functionality ("Hi Tom, welcome back") and got it wrong.
Tom never used Facebook. He preferred a different social networking platform.
I reported a similar issue in GitLab a while back where an incorrect password, entered in the login form, was echoed back to the user in the registration form! IIRC the registration form was picking up on the validation failure in the login form and filling itself in with the submitted form details.
I hope we fixed that.
Yes, I reported it as https://gitlab.com/gitlab-org/gitlab-ce/issues/14552 (confidential so you need permission to see) and it was fixed in https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3691
Cool, I removed the confidentiality from the issue. Thanks for reporting this.
I wish this incident was really an elaborate hiring scheme.