PurseIO

Date: 2015-07-31

Guessable ids and sequences allowed the researcher to scrape private order data from PurseIO service.

PurseIO is a service where one can pay in Bitcoin for somebody to ask him or her to make an Amazon order on the behalf of the payer.

PurseIO AJAX call endpoint had guessable id sequence, allowing the researcher to scrape semi-private data.

Related evaluation points:

• Authorization and permission framework
• Non-guessable IDs

Links:

• Purse.io Data Spelunking