Episode
15 October 2019 Official episode · Official transcript
research bug hunter
The episode features Robert Baptiste, known online as Elliot Alderson, and his discovery of security weaknesses in Android applications, Firebase databases, Aadhaar-related systems, Indian websites, and the 63red application.
Topics: Android application reverse engineering, APK extraction and decompilation, AndroidManifest.xml analysis, Firebase database access-control configuration, Exposed database URLs and API keys, Unauthenticated read/write access, Session-token exposure, Aadhaar identity and biometric-data security, Google search-based exposure discovery, Automated web scraping, Arbitrary file upload, Predictable or modifiable URL access, API security, Client-side credential exposure, Doxing and redacted disclosure, Grey-hat vulnerability research, Responsible disclosure and public disclosure
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Mr. Robot MENTIONS Elliot Alderson
The show Mr. Robot has Elliot Alderson as its main hacker character.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“There’s a TV show called Mr. Robot. Elliot Alderson, he’s the main character. He’s a hacker.”
Robert Baptiste SAME_AS Elliot Alderson
Robert Baptiste uses Elliot Alderson as his Twitter identity and says he can be called Robert or Elliot.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“he said his name is Robert Baptiste”
“You can call me Baptiste, Robert, Elliot.”
Elliot Alderson USES Reverse engineering
Elliot posts useful information about reverse-engineering and specializes in reverse-engineering applications.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“he’s posting real and useful information about reverse-engineering”
“he loves reverse-engineering them”
Elliot Alderson USES Android
Elliot's expertise is in Android applications, and he began his career as an Android developer.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Robert’s expertise is in Android applications”
“He started his career as an Android developer”
Elliot Alderson USES security research without authorization
Elliot performs vulnerability research on applications without explicit authorization, describing himself as between a white hat and a grey hat.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I don’t have the authorization, the explicit authorization to find these kinds of vulnerabilities.”
“You can consider me between the white hat and the grey hat”
Donald Daters USES Android
Donald Daters is described as an Android application.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“a new Android application called Donald Daters”
Donald Daters USES Firebase
The Donald Daters application uses Firebase as its online database.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“they used Firebase database, which is a service offered by Google”
APK CONTAINS AndroidManifest.xml
An APK contains the application files, including AndroidManifest.xml.
Explicit Direction flagged Confidence 99% · Jack Rhysider EP 49 Details
“This showed him a file called [00:05:00] AndroidManifest.xml.”
Elliot Alderson USES APK
Elliot moved the Donald Daters APK to a computer, extracted its files, and decompiled the application.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot moved the APK from his phone to the computer, then he extracted the files from the APK and decompiled the app.”
Firebase security rules misconfiguration AFFECTS Firebase
The Firebase database was exposed because debug settings and permissive security configuration were left enabled.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“They kept the debug settings on so it was pretty easy to get everything.”
“There was zip for permission and security there”
Donald Daters database exposure INVOLVES Firebase security rules misconfiguration
The Donald Daters database exposure involved Firebase debug/security settings being left open.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“This is a scandal because they kept the debug sitting on Firebase.”
Donald Daters database exposure COMPROMISES Firebase
Elliot gained access to the Donald Daters Firebase database and could view its contents.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Within five minutes, Elliot has gained access to the entire Donald Daters database.”
“I had access to everything; all the messages, all the people’s details.”
Firebase security rules misconfiguration DISCOVERED_BY Elliot Alderson
Elliot discovered the Firebase exposure while inspecting the Donald Daters application.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot took this Firebase URL that he found in the app and tried to see if he could see what’s in the Donald Dater’s database.”
public Aadhaar-number exposure INVOLVES Aadhaar
The incident concerned Aadhaar numbers and cards exposed publicly online.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Within three hours, Elliot found 20,000 Aadhaar numbers listed publically online”
Elliot Alderson USES Google search queries
Elliot used Google search queries to locate publicly exposed Aadhaar cards and numbers.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“with some pretty good search query, I found a lot of Aadhaar cards”
Elliot Alderson USES web scraping
Elliot created an automatic scraper to retrieve Aadhaar data from publicly accessible sources.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I created an automatic scraper in order to retrieve all the data automatically.”
Elliot Alderson USES Python
Elliot published the Python script used in his Aadhaar search challenge.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“he put his Google searches and Python script onto his GitHub account”
Elliot Alderson USES GitHub
Elliot published his Aadhaar search queries and Python script on GitHub.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“onto his GitHub account and published it for everyone to see”
Aadhaar web application weaknesses DISCOVERED_BY Elliot Alderson
Elliot says he found five or six issues in the Aadhaar web application after followers directed him to it.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I found five or six different issue in their application”
Narendra Modi website upload vulnerability DISCOVERED_BY Elliot Alderson
Elliot discovered a vulnerability in Narendra Modi's website that allowed arbitrary file uploads.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“He discovered a vulnerability on it which allowed him to upload whatever file he wanted to their site.”
Indane Aadhaar-number exposure INVOLVES Indane
The Indane exposure involved Aadhaar numbers of Indane users being accessible through modified URLs.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“The URL was a website called Indane. It’s a gas company in India”
“there was Aadhaar number of Indane users”
Indane Aadhaar-number exposure INVOLVES web scraping
Elliot used an automatic scraper to enumerate the exposed Indane records and estimate the scale of the exposure.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“I wrote an automatic scraper in order to do my request automatically.”
“It was 6,700,000.”
63red is described as an app built using HTML5.
Explicit Confidence 95% · Jack Rhysider EP 49 Details
“you can just make the app in HTML 5 using JavaScript”
63red USES JavaScript
The 63red application exposed JavaScript used to create its website-like interface.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot was able to see all the JavaScript used to create this website app”
63red API vulnerability AFFECTS 63red
The 63red API vulnerability allowed unauthenticated users to modify accounts and otherwise control database contents.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“There was no authentication process so everybody has the ability to modify, to do whatever they want.”
63red API vulnerability DISCOVERED_BY Elliot Alderson
Elliot says he quickly found a major vulnerability in the 63red API.
Explicit Confidence 99% · Elliot Alderson EP 49 Details
“Very quickly I managed to find a big vulnerability in their API.”
Elliot Alderson USES Have I Been Pwned?
Elliot checked R S Sharma's email address against Have I Been Pwned and found it in a breach.
Explicit Confidence 99% · Jack Rhysider EP 49 Details
“Elliot checked his e-mail in haveibeenpwned.com and yep, the e-mail was in a breach as well.”
Elliot Alderson USES doxing
Elliot explicitly rejects characterizing his redacted publication about R S Sharma as doxing, while describing doxing as bad.
Uncertain Confidence 84% · Elliot Alderson EP 49 Details
“Doxing is very, very bad and people shouldn’t do it.”
“This is not doxing. The goal was not to dox him.”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:08:31.764212+00:00