Technique
technique:client_side_validation_bypass
Bypassing browser-side limits and submitting data directly to a service API.
Bypassing browser-side limits and submitting data directly to a service API.
“the limitation on the profile pictures was – you could only have twelve photos. I thought it would be funny just to have a thirteenth photo. It’s just a limitation that they had. No one would really notice. You’d really have to think about it or know this limitation even to realize, but I thought that would be subtle and funny. JACK: Samy figured out that the limitation on the number of photos that MySpace users were allowed to post was set by client-side validation”
“he could submit as many photos as he wanted to MySpace”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | USES | Samy Kamkar | Explicit | 61 |
Samy Kamkar USES client-side validation bypass
Samy bypassed MySpace's client-side photo-count validation and submitted additional photos directly to the API server.
Explicit Confidence 99% · Jack Rhysider EP 61 Details
“he could bypass this validation and talk directly to the API server”