Okay, so today I wanted to mess around with this “date takeover” thing I saw floating around. Basically, it’s about finding websites where you can change some date value and potentially cause some, uh, interesting results. Maybe even score some free stuff, who knows?
Getting Started
First, I needed a target. I decided to go after some smaller, lesser-known websites. I figured they might have weaker security. I’m not trying to, like, hack the Pentagon or anything.
I spent some time Googling around for sites with online booking, reservation, or scheduling features. Those seemed like good places to start, you know? Places that deal with dates all the time.
The Digging Begins
I found a couple of potential targets. One was a small, local spa that offered online booking. Another was a site for reserving picnic areas in a park. I fired up my browser’s developer tools – that’s the F12 key, for those not in the know – and started poking around.
I started with the spa’s website. I went through the booking process, and when I got to the date selection part, I started messing with the values. I inspected the date input field, tried changing the “min” and “max” attributes. I also tried putting in dates way in the past, way in the future, stuff like that.
- First Try: Changed the “min” date to something super old. No dice. The website just gave me an error.
- Second Try: Tried a date far in the future. Nope, still an error.
- Third Try: I tried messing with the date format, switching from MM/DD/YYYY to DD/MM/YYYY. Still nothing.
The spa website seemed pretty solid. I moved on to the park reservation site.
Picnic Time?
This site was a little different. Instead of a fancy calendar picker, it just had a simple text field for the date. Jackpot?
I tried the same tricks as before, past dates, future dates, weird formats. Still, the website kept giving me errors. It was validating the input, preventing bad information.
I change the date and inspect the network. It seems the date parameter has been sent to the backend.
After I tried it again and again. I finally find something intresting. The website accept the date format like: `2024-11-11` and `20241111`.
I tried to change the date value to `2024111`. BOOM! The backend return a 500 error!
The Conclusion (For Now)
The website maybe vulnerable to some attack. I will try more payloads later to test it.
So, that’s my date takeover adventure for today. Stay tuned, maybe I’ll try other things.
