---
id: 8147
title: "Insecurity Through Obscurity"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/web-application-pentesting/insecurity-through-obscurity/"
published_at: "2018-01-22T00:00:00Z"
tags: ["privilege-escalation", "web-security", "user-management", "security-through-obscurity", "predictable-identifiers"]
phying_url: "https://phying.com/item/8147"
lang: en
---

# Insecurity Through Obscurity

## Summary

A hidden ContactId that looked randomly generated turned out to use a predictable encryption scheme, letting the tester enumerate and edit superuser accounts for full admin takeover.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2018-01-22T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/web-application-pentesting/insecurity-through-obscurity/
- **Phying News:** https://phying.com/item/8147