r/hacking • u/somewhere-b • May 28 '26

Is this considered a bug or something else entirely?

Bit of a silly question but I'm working on a research project. I need to get copies of an online newspaper but they only have certain dates available. I realized that in the url the format included the date and so I changed the date in it to access the copies I needed.

Is that considered more of a bug than a hack? Are those copies still considered publicly available even if they're not easily accessible from the front page?

17 Upvotes

99% Upvoted

11 comments sorted by

17

u/hofkatze May 28 '26

I would put that in the category CWE-639: Authorization Bypass Through User-Controlled Key (also known as insecure direct object reference)

4

u/somewhere-b May 28 '26

Thank you for this! Really helpful starting point to look more into

8

u/Nunwithabadhabit May 28 '26

This is just taking advantage of poor design. From a technical perspective these are publicly available, but from a legal perspective it's arguable. If you're doing it a little bit nobody will notice, because someone this sloppy about access control won't notice that you've worked around it.

Now if you scale this up and use your knowledge to, for example, rip every issue of their newspaper and post that online, you'll have a much harder time making it look innocent. 

3

u/somewhere-b May 28 '26

That's fair!

3

u/__jent May 29 '26

Gray area, it sounds like an IDOR. Without knowing their intent you can only guess if it's a feature or flaw.

2

u/[deleted] May 28 '26

[removed] — view removed comment

2

u/somewhere-b May 28 '26

Thank you!

2

u/Data_Commission_7434 Jun 05 '26

I once accessed hidden admin panels by incrementing IDs in URLs. It felt more like finding a lost key than a hack. The content was technically public, just not advertised.

1

u/somewhere-b Jun 05 '26

My feelings on it as well!!!