samcurry.net resources

samcurry.net

Resources curated from this publisher and indexed across appsec.fyi topic pages. Last item added: 2026-08-17.

Date Added	Resource	Excerpt
2026-08-17 2026	Leaked Secrets and Unlimited Miles: Hacking the Largest Airline and Hotel Rewards Platform AuthZ Secrets	Writeup detailing vulnerabilities found in points.com, the backend for major airline and hotel rewards programs. The research uncovered a directory traversal flaw granting access to 22 million order records containing sensitive customer data. Further authorization bypasses allowed attackers to transfer reward points and leak customer information using only rewards numbers and surnames. Leaked tenant credentials for the Virgin rewards program enabled API request signing on behalf of the airline, while a weak Flask session secret on the global administration website provided full super administrator permissions.
2026-08-17 2026	Hacking Millions of Modems (and Investigating Who Hacked My Modem)SSRF XXE	Writeup detailing an investigation into unexpected HTTP traffic replay, tracing it to a compromised Cox Panoramic Wifi gateway modem. The investigation identified a DigitalOcean IP address previously used for phishing sites like `isglatam.online` and `isglatam.tk`, and mail server domains, suggesting a multi-year malicious campaign. Replacing the modem resolved the issue, leaving the specific compromise method on the modem unexamined.
2026-08-17 2026	Hacking Kia: Remotely Controlling Cars With Just a License Plate AuthZ	Writeup detailing remote car control vulnerabilities in Kia vehicles, allowing attackers to manipulate functions solely with a license plate. The research identified flaws in the Kia Connect app and dealer portal, enabling unauthorized access to vehicle functions and personal data. The writeup highlights the exploitation of API endpoints and registration processes, demonstrating how an attacker could gain control by registering as a dealer and generating access tokens.
2026-08-17 2026	Hacking Subaru: Tracking and Controlling Cars via the STARLINK Admin Panel AuthZ	Writeup detailing the compromise of Subaru's STARLINK Admin Panel, which allowed unrestricted access to customer vehicles and data. The vulnerability stemmed from an unprotected `/forgotPassword/resetPassword.json` endpoint, enabling account takeover of employee credentials by exploiting an email enumeration endpoint (`/adminProfile/getSecurityQuestion.json`). This allowed attackers to remotely control vehicles, track their location history, and access sensitive PII with minimal victim information.
2026-08-17 2026	Hacking the World Poker Tour: Inside ClubWPT Gold’s Back Office AuthZ	Writeup detailing a vulnerability discovery within ClubWPT Gold's back office, stemming from a misconfigured development environment. The research utilized tools like `ffuf` and `GitHack` to uncover an exposed `.env` file containing Alibaba cloud credentials and usernames. Exploiting a weak password ("123456") for the "eg3478" user on the staging environment granted access to sensitive administrative functions, including player KYC details and transaction history. The vulnerability was reported and patched without malicious exploitation.