Oops, I Hacked It Again: Tales and disclosures

Oops, I Hacked It Again: Tales and Disclosures

Speaker: Ignacio Navarro — Independent Security Researcher

Conference: NorthSec 2025 — May 15–16, 2025, Marché Bonsecours, Montreal

Watch on YouTube: https://www.youtube.com/watch?v=oB4_aK6FeYc

Reading time: ~6 minutes

TL;DR

Ignacio Navarro, an application security engineer from Argentina, walks through a series of real-world vulnerability discoveries across a supermarket chain, a ticketing platform, a loyalty card system, and a contactless payment platform. Each tale follows the same arc: a mundane consumer interaction, opportunistic reconnaissance, a cascade of exploitable misconfigurations, responsible disclosure, and a mixed bag of vendor responses. The unifying lessons are about the mechanics of ethical disclosure, the importance of IDOR awareness, and how persistence and curiosity pay off more than specialised tooling.

Introduction

The title is a deliberate nod to a pop-culture artifact, and Ignacio Navarro owns it unapologetically. At 27 years old, working as an application security engineer at an insurance company in Argentina while also presenting at conferences across more than fifteen countries, he has developed a signature approach to ethical hacking: start from a consumer touchpoint, follow the data wherever it leads, and report what he finds regardless of how the company responds.

His NorthSec 2025 talk is structured as a series of hacking tales — short, narrative case studies that each illuminate specific vulnerability classes and disclosure dynamics. The technical concepts are deliberately accessible. The real value is in the cumulative picture of how real-world web applications fail, how organisations respond to disclosures, and what a researcher can realistically expect when engaging with companies that did not ask to be tested.

Tale 1: The Loyalty Card Platform — IDOR at Scale Across 70 Countries

Navarro had previously presented at NorthSec about vulnerabilities in a loyalty card platform used by more than 2,000 installations across 70 countries. The disclosure story continued into this year's talk.

▶ Watch: Loyalty card platform follow-up and disclosure outcome (0:00)

The original vulnerabilities — which allowed an attacker to access all customer accounts, manipulate card balances, earn prizes multiple times, and charge arbitrary amounts — were reported through a combination of email outreach and an in-person meeting with the company's CDO in Colombia. The company expressed cooperation during the meeting and agreed to remediate. The written report that followed went unanswered. No acknowledgement, no timeline, no CVE coordination. Navarro continued presenting the research across multiple countries where the platform operated, maintaining public pressure. By September, some fixes quietly appeared in production, still without any official communication.

When Navarro revisited the platform while preparing this talk, he found a newly launched contactless payment module. A quick look at the HTTPS certificate revealed an expired certificate. A directory scan exposed a public .git repository, which he cloned. Inside: API tokens, private keys, and sensitive configuration data — effectively the same category of misconfiguration as the original findings.

Tale 2: The Supermarket Chain — Chained Misconfigurations to Root Access

A Sunday afternoon, an ergonomic chair, and a supermarket loyalty card: Navarro's second story begins domestically and escalates dramatically.

▶ Watch: Supermarket chain — customer portal and IDOR discovery (4:00)

The customer portal assigned each loyalty card a sequential numeric ID, the classic indicator of an Insecure Direct Object Reference (IDOR) vulnerability. Enumerating IDs yielded card data, but not enough to cause serious harm on its own. Returning to the web application, Navarro found an exposed error log. The requests in the log originated from localhost — but an X-Forwarded-For header in those log entries contained a public IP address. Scanning that IP revealed an older, separate customer portal running on port 80.

▶ Watch: Chaining from exposed logs to root MySQL access (6:00)

The old portal had no public vulnerabilities but exposed a text editor endpoint with a sequential file ID. Files stored through that endpoint contained credentials: WordPress admin passwords, FTP credentials for the website, and SSH credentials with root access. With MySQL also exposed on the server, Navarro gained full read/write access to the database: all employee records, all customer purchase histories, card data — and the ability to modify prices across every supermarket in the chain.

Tale 3: The Ticketing Platform — Account Takeover via Sequential Admin ID

A rave at a lakeside venue prompted a ticket purchase; the ticket purchase prompted a look at the customer account portal.

▶ Watch: Ticketing platform — admin account takeover (8:00)

User accounts had sequential numeric IDs. The API allowed authenticated users to change the email address on an account — any account. The admin account, naturally, had ID 1. Navarro changed the admin email to one he controlled, triggered a password reset, and gained access to the full management console: event sales data, all user PII, the ability to generate free tickets, and control over financial records for every event on the platform. The platform turned out to be a multi-tenant system serving events across 80 cities with over one million ticket purchasers per year.

Tale 4: The Gift Card Benefits Platform — Pre-Login Authentication Bypass

The final case originates from an internal audit at Navarro's own employer: a corporate benefits and gift card platform used to provide employee perks.

▶ Watch: Pre-login authentication bypass and credential exposure (12:00)

The login flow called a pre-login endpoint (wwsconsume.php) to verify that a client ID existed before presenting the password form. The pre-login response returned not just a confirmation but the user's full profile — name, address, phone number, and the password encrypted. The subsequent authentication step submitted that same encrypted password back to the server, which accepted it as valid. In effect, the pre-login endpoint handed the attacker the encrypted credential needed to authenticate, making the password itself irrelevant.

Navarro reported the finding to the platform's CTO and demonstrated it live on the CTO's own account — revealing, in the process, a pattern of high-value gift card transactions totalling close to a thousand dollars per month. The vulnerability was patched the following week.

On Disclosure Ethics and Vendor Realities

Across all four cases, Navarro is deliberately non-prescriptive about what "ethical hacking" means. He acknowledges that there is no single definition, that permission is often ambiguous in consumer-product testing, and that outcomes vary widely based on vendor maturity and incentives.

▶ Watch: Disclosure ethics and vendor response patterns (14:00)

The common thread in his approach: he does not exploit findings for personal gain, he makes a genuine effort to report, and he accepts that many vendors will ignore disclosures, patch silently, or respond defensively. The ticketing platform's operators reportedly disputed the severity of the account takeover finding in the meeting — until the live demonstration on a screen proved otherwise. The loyalty card company never replied at all but fixed the issues eventually. The supermarket chain and gift card platform engaged more constructively.

The tools Navarro relies on are deliberately ordinary: browser developer tools, Burp Suite, standard port scanners, and simple scripting. The message is that the vulnerability classes he finds — IDOR, exposed credentials, missing tamper protection in payment flows, .git directory exposure — persist in real production systems not because attackers use sophisticated techniques but because developers ship predictable mistakes and organisations do not test for them.

Notable Quotes

"There is not just one reality for what we do here. It could be whatever you want, in certain point."

"They never talked at any point about security — so they are right, at a certain point."

"I didn't [change the prices and shop for free]. I just wanted to let you know."

"Who am I to judge the people?"

Key Takeaways

• IDOR remains endemic. Sequential numeric IDs in user-facing APIs continue to expose customer data and enable account takeover across consumer platforms of all sizes.
• Error logs are reconnaissance gold. Exposed server logs, even when requests originate from localhost, can contain IP addresses, internal hostnames, and credential fragments that extend an attacker's foothold.
• Chaining low-severity findings creates critical-severity impact. An exposed log file plus an old portal plus a text editor with sequential IDs led to root-level database access — no single step was dramatic in isolation.
• Payment flow tamper protection is still missing in production. A system that accepts attacker-supplied transaction amounts without server-side validation is not an exotic finding; it is a recurring one.
• Disclosure is unpredictable. Vendors range from fully cooperative to completely unresponsive. Continued public presentation of research appears to be one of the few levers that drives silent remediation when formal channels fail.