Summary

At the beginning, I analyzed the website’s JavaScript code and found that it stores a lot of information in the local storage, which is not the best place to keep site-related data, especially if it is sensitive. After that, I checked the local storage and found some endpoints, just as I expected from my analysis of the JavaScript file. Among these endpoints, I found data related to the usernames of private users, not for public access. Better luck to everyone.

Activity Feed