bobdahacker blog
npub1v9esph453uv0hxh5wagednc9zq97fx8dsvzyfvpd35js9ezjfctqzrjpe2@drss.io
cybersecurity insights, hacking tutorials, and digital security research
Follow into
tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
Save into
4 Aug 2026
How a missing Firestore security rule on tl;dv exposed 181,874 meetings from 84,312 users across 35,003 domains, including live calls I could join uninvited, and how six months of disclosure got me
Click to Pray, Click to Leak: The Pope's Official App Exposes 700,000+ User Emails
Save into
24 Jul 2026
How I found that anyone can pull the email address, name, country, and date of birth of any of the 719,517 users on Click To Pray, the Pope's official prayer app, with a single GET request. Reported
Your Boarding Pass Is a Skeleton Key. Frontier Airlines Doesn't Care.
Save into
16 Jun 2026
How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a
I Could've Rickrolled the Entire FIFA World Cup. All I Needed Was My ID.
Save into
15 Jun 2026
How I found that anyone could register on FIFA's public Agent Platform, gain access to the Football Data Platform's Streaming Management panel, and get RTMP ingest URLs and stream keys for every live
Petlibro: Your Pet Feeder Is Feeding Data To Anyone Who Asks
Save into
27 Dec 2025
How I found critical vulnerabilities in Petlibro smart pet feeders allowing complete account takeover via broken OAuth, access to anyone's pet data, device hijacking, and private audio recordings -
Bandsintown: How I Almost Rickrolled 191k People
Save into
26 Dec 2025
How I found a verification bypass in Bandsintown that let anyone claim unclaimed artist pages with a single API call - including Rick Astley's 191k followers, their emails, and the ability to send
Taimi: Finding Everyone's Private Photos Was Easy, But So Was Getting Paid
Save into
26 Dec 2025
How I found critical IDOR vulnerabilities in Taimi that exposed "expiring" videos, private photos through a bizarre location feature, and allowed fake system messages - and how they actually handled
I Hacked BellaBot and Every Robot from China's Biggest Robotics Company (Pudu Only Fixed It When I Told Their Clients)
Save into
29 Aug 2025
Critical vulnerabilities in Pudu Robotics allowed unauthorized control of every Pudu Robotics Robot worldwide. They ignored emails until I contacted Skylark Holdings and Zensho about their
How I Hacked India's Biggest Dating App (They Offered Me a $100 Gift Card)
Save into
19 Aug 2025
Flutrr, India's biggest dating app backed by The Times of India, has critical security flaws allowing anyone to access all user data, send messages as anyone, and control any account. They've known
When South Park's Restaurant Had Worse Security Than Cartman's Password
Save into
18 Aug 2025
How I found critical security vulnerabilities in Matt Stone and Trey Parker's Casa Bonita restaurant, exposing customer data, payment info, and their entire POS system - plus how I accidentally got a
How I Hacked McDonald's (Their Security Contact Was Harder to Find Than Their Secret Sauce Recipe)
Save into
18 Aug 2025
How I found critical security vulnerabilities in McDonald's systems affecting millions of employees, and had to cold-call their HQ pretending to know security staff just to report them.
