As someone who runs the technical team for a hackathon (shameless plug [https://www.deltahacks.com](https://www.deltahacks.com/)), I know a lot (maybe too much) about the architecture behind most attendee management systems. I also like to poke holes in programs, and when you put those together, I've spent countless hours trying to get into hackathons without actually applying. It's fun for me and also helps the organizing teams because I disclose any exploits I find after discovering them.

When the applications for HackMIT 2025 went live, I immediately started looking for exploits. I attended the hackathon last year _legitimately_, so this time I was more curious about loopholes in their system. Like any other web reverse engineering, the first (and arguably easiest) place to look is the network requests. Here are the requests for [https://plume.hackmit.org/](https://plume.hackmit.org/) (HackMIT's attendee management website) after logging in.  
![](https://cdn.sanity.io/images/fapcvjm4/production/7e50cc35340615d8bbb2fcbef466d67f70ba956d-3024x1750.png)

Looking through the requests, the `/whoami` endpoint has some interesting properties:

![](https://cdn.sanity.io/images/fapcvjm4/production/cfe7f0fa4ae4eb26d1fa1589baf081757430b82b-1406x788.png)  
Could there be some client-side UI hidden behind the `isAdmin` flag? (In the book-writing business, they call this _foreshadowing_.)

Let's find out! To see what might be hidden in the frontend if we were to get an `"isAdmin": true` response from the backend, we can use a handy tool called [Proxyman](https://proxyman.com/). This tool has many features and lets you do all sorts of man-in-the-middle shenanigans, but we're specifically interested in the `Map Local` tool.

![](https://cdn.sanity.io/images/fapcvjm4/production/bd90e26ddcbf1cd814220b5a3dec707e7f3a9c96-3024x1964.png)

Basically, Proxyman installs a proxy on your system that sits between incoming/outgoing network requests. The `Map Local` feature allows you to mock the response from an endpoint by defining a local JSON file. This is an amazing tool for exposing client-side features that rely on server flags. As you guessed, we'll set the `isAdmin` key to true, tricking the frontend logic into thinking the user is an admin. To use this tool, we first find the request to the `/whoami` endpoint inside Proxyman. While it's running, we refresh the webpage in the browser, and if you have SSL decryption enabled, you'll see the same request from the browser's network tab inside Proxyman.

![](https://cdn.sanity.io/images/fapcvjm4/production/97480ad9bcd3b380156a4762654a4013a2f6993d-2610x952.png)

We're in business—now we can map this request to a local JSON object.  
![](https://cdn.sanity.io/images/fapcvjm4/production/ad1c69c315a0d25171c84149a564be640879235e-1434x1201.png)

Inside the `Map Local` tool, we should see the "actual" JSON response with `isAdmin` set to false. We'll switch this boolean to true and save. We're done with Proxyman now; we just let it run in the background.  
![](https://cdn.sanity.io/images/fapcvjm4/production/f87f32874fbac766ee94e1e08c6e5b5b7db2560f-2176x1592.png)

Voila! We now see some new sidebar items meant only for admin users.

![](https://cdn.sanity.io/images/fapcvjm4/production/21f5b11a86cc3561a3629f385432065ce4535752-3008x1682.png)

Most of these pages either won't load or require authentication on their endpoints, which is how things **should** be. But after exploring around, there's an "add hacker role" function that allows bulk management of hacker statuses. The endpoint for this action is not authenticated, meaning any user can change the status of their own application **and** any other user's application if they know the user's email. As far as exploits for a hackathon attendee management system go, this is as bad as it gets. Initially, my status was "Application Submitted," the default when you apply. Using the vulnerable endpoint, I can mark myself as "Admission Confirmed," essentially accepting myself into the hackathon.

![](https://cdn.sanity.io/images/fapcvjm4/production/6b03ef7357b1c838f4cc4df2e82d3b6249c71cb6-2420x1710.png)  
Checking the network tab, we see the problematic endpoint is `https://plume.hackmit.org/api/v3/user/add_hacker_roles`. Instead of checking roles and returning a 403 error, we get a 200 success response. We can also verify that the data in the database has actually been modified by returning to the `/user/` page.  
![](https://cdn.sanity.io/images/fapcvjm4/production/14834abb5898e8d1e5c224c79ce6883c10639f28-2336x1458.png)

Two other endpoints are similarly vulnerable and are used for managing judge, mentor, and other roles.

The lesson here is always to authenticate your endpoints. Even better, create the correct hierarchy for your endpoints and have admin endpoints require authentication by default. Humans make mistakes, and LLMs are especially susceptible to causing security vulnerabilities. By enforcing proper role checking in your backend architecture, you can ensure these mistakes are _almost_ impossible. HackMIT has some of the best developers on their technical team, and most of their endpoints are secure, but without proper architecture, anyone can make mistakes.

Write up of exploits found on HackMIT attendee portal

How Did I Hack,MIT

this is my journey through buildspace s5. i'm going to use the same lowercase everything format that buildspace uses to match the theme. in terms of reasoning i'm not sure what the lore is yet. i will ask farza if i meet him at some point.
## week 0
heard from a friend that buildspace s5 is happening and got a buddy pass invitation.
spent the whole week thinking about what to work on but nothing too interesting came up.
![](https://cdn.sanity.io/images/fapcvjm4/production/2ca9ffd1e4e2f0989c81fa857be02792a233bb29-1446x442.png)
on saturday after watching the kickoff with fellow builders at [soto](https://lu.ma/soto), an attendee was looking to get food since they came all the way from waterloo. he went around and asked around for food recommendations, some suggested a bunch of places and some said they don't know and by the end he didn't seem set on a place to go either. that feeling of being overwhelmed was too familiar since i struggle with the same choice overload when looking for places to go as well. while the words of farza telling everyone to "build something that they themselves will use" was fresh in my head, i decided to try and do something about this choice overload or more formally known as [decision fatigue](https://en.wikipedia.org/wiki/decision_fatigue). i'm not a psychiatrist or some kind of human behaviour expert, but i do know how to code and create software that helps with everyday problems. so, time to update the apple notes:
![](https://cdn.sanity.io/images/fapcvjm4/production/e5473766bb3d48d6888cbbbfddf021b7156b7357-1378x168.png)

## week 1
i was attending collision this week so i didn't have much time to think and explore other ideas. i didn't even get to watch the first lecture. so when it was time to lock in an idea and create a intro poster for it i went with the idea that would be the most help to myself.
the task of this week was to create the intro poster and share it on social media to get feedback on your idea. this is what i ended up with:
<blockquote class="twitter-tweet" data-theme="light"><p lang="en" dir="ltr">llms can be very random because end of the day they&#39;re just highest probability sentence generators. i&#39;m planning to take advantage of that to help myself with decision fatigue and hopefully others will find it useful as well. s5 submission<a href="https://twitter.com/_buildspace?ref_src=twsrc%5etfw">@_buildspace</a> <a href="https://twitter.com/_nightsweekends?ref_src=twsrc%5etfw">@_nightsweekends</a> <a href="https://twitter.com/farzatv?ref_src=twsrc%5etfw">@farzatv</a> <a href="https://t.co/lkarz1bfov">pic.twitter.com/lkarz1bfov</a></p>&mdash; arian (@thearian81) <a href="https://twitter.com/thearian81/status/1803854231461597701?ref_src=twsrc%5etfw">june 20, 2024</a></blockquote> <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>

while creating the poster i decided that the name "just1" looks cooler than "just one" so that's the name i chose. suddenly i realized i will also need a domain and in a rare strike of genius i snatched the domain [just1.place](https://www.just1.place/) for a whopping $24. i didn't have much to put there so i just took the poster i had and remade it in react so it can be the landing page while i cook the main project.

i haven't really discussed concretely what just1 is going to be so here's a brief description of what i've planned the project to be so far,

> [!info] what is just1
> using reviews from google maps, comments from websites like reddit and internal upvoting system and feeding it to an ai system, suggest one and only one activity, restaurant, etc based on user's need

now i don't know how much of this i can do for buildspace but the main goal is to have a usable product that can suggest only one option so you don't have to make a choice, the ai made the choice for you.

that's it for first week. i'm gonna start coding an mvp next week.

## week 2
i was really busy with personal life this week, to the point of just collapsing on bed and sleeping when i got home every night. on the weekend, i went on a camping trip where i had very limited, slow internet. i couldn't do much as far as developing the project goes, but i realized my project's first pitfall:

> [!error] pitfall 1
> the google places api, which i was planning to base all of my project on, only gives 5 reviews per place. it's the same deal with all the other providers like yelp.

this issue left me with 3 options:
1. give up on feeding the model with a lot of reviews and just rely on the few reviews provided by the api. this is the easiest solution, but it will affect the output quality drastically.
2. use a third-party api like [serper api](https://serpapi.com/google-maps-api) to get access to all reviews. this would be amazing as, in terms of complexity, it's as easy as using the google official api, but the problem is that this api is extremely expensive. i would be burning through $70 before even finishing development.
3. write my own scraper to get the reviews from google's private apis used on google maps. this solution would give me access to the data for free, but writing a scraper is more complicated than using an official api, and it's against google's terms of service!

![](https://cdn.sanity.io/images/fapcvjm4/production/14d042affb1d1e1e3741cc0bb3406550357bbcf5-1808x294.png?w=450)

i spent most of my weekend thinking about which approach to go with before doing much coding because this is crucial in the process of making this app.

i ended up going with the first approach while developing the app and upgrading to a better method when the rest of the app is fully developed. however, while evaluating those solutions and thinking about the app architecture, i came up with an ingenious (if i say so myself) method of calling the api. it relies on how the api calls are made to the maps api.

following is the json sent to the api to get nearby places:

```json
{
   "includedtypes":[
      "ice_cream_shop", "restaurant"
   ],
   "maxresultcount":10,
   "locationrestriction":{
      "circle":{
         "center":{
            "latitude":[latitude],
            "longitude":[longitude]
         },
         "radius":5000.0
      }
   }
}
```

most of the values are hardcoded. the result count would stay the same when settling for a value that gives the best results through trial and error, and location data comes from the browser's geolocation data. the radius is also a constant value which would be reasonable for a walkable destination. there will be an option for the user to increase the radius if no results have been returned by the model. the part of the body that's most important and needs to be dynamic based on the user query is the `includedtypes`. this parameter decides what types of locations to be returned by google's api. this is a perfect use case for an llm to run categorization on the query by the user to figure out what kind of location types should be included.

## week 3

going to post about my weekly experience doing buildspace s5

buildspace s5 weekly shenanigans

# Let the journey begin

I will be posting random tech deep dive, solution to issues I've solved, comments about companies and their practicies and anything that's going on in tech world. 

This will be mostly my outlet so I don't want to be as concerned with trying to write the most fleshed out blog posts but I try to make posts as coherent as possible.

How Did I Hack,MIT

Write up of exploits found on HackMIT attendee portal

buildspace s5 weekly shenanigans

going to post about my weekly experience doing buildspace s5

Hello world

First post to get things going