Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

At hacker congress this year, some of the folks found a vulnerability in the check in kiosk. Shocker!

When checking in at the hotel terminal, the lookup function required an alphanumeric booking ID. When submitting an incorrect code, an error appears, as expected.

When providing dashes (-), it would display all booking IDs. This appears to be a master code or a test function for debugging. The review contains a booking ID, timestamp and the total price.

If you click on the room number then it would output the room number. By getting all IDs from the first bug, then you'd be able to get the room code. Yikes!

Only requiring a booking ID for a room code is not great. These may be leaked by discarded invoices or print outs. How would we fix this? Further data should be required, such as an ID, passport number, PIN code that was emailed or something else.

Overall, a fairly funny and old school issue.