EXPOSEDIDORPII LEAK
0x21cracks.com — the "security research platform" that can't secure a single API route
A cheat marketplace with a casino bolted on — Discord logins, paid crack vault, coin economy, gambling games — and every endpoint that matters answers strangers. We didn't break anything. We asked politely, and their API opened the vault, the user list, and the till.
registered 2026-08-07 (NameCheap) · Cloudflare Turnstile front · Next.js/turbopack · vault lives on public Vercel Blob store 5pbaq6diqf0hkqkn.public.blob.vercel-storage.com
what's leaking — all of it unauthenticated, right now
| endpoint | what it hands over | verdict |
|---|
| /api/reviews | 125 verified-customer reviews — discordId, username, avatar per buyer | PUBLIC |
| /api/leaderboard | 50 sellers — Discord identity + uploads/sales + totalEarned + balance (the till, public) | PUBLIC |
| /api/profile/{username} | any account → discordId + profile, resolvable by name | PUBLIC |
| /api/download/{id} | IDOR — vault assets by sequential id; free-tier files redirect to the public Vercel blob. id=10 served us a 250KB installer script, zero auth | IDOR |
| /api/messages/count | internal message counters without a session | PUBLIC |
| /api/settings/maintenance | maintenance config + scheduled end date | PUBLIC |
| /api/admin/* | admin sponsors/upload routes exist — cookie-only boundary | 401 (for now) |
| /api/download/{bad-id} | 500 on malformed ids — unhandled-error gap in the delivery path | ERROR LEAK |
the punchline
They sell "curated security research tools, verified community releases" — while their own release pipeline leaks the verified community. The storefront is a Next.js reskin over a public blob bucket, the auth model is "does the request feel logged in", and their crown-jewel endpoint — the one that serves the actual paid cracks — enumerates by /api/download/1, /api/download/2, /api/download/3…. A national registry, a university, a hospital — those leaks are negligence. This one is a security shop shipping a public IDOR. The challenge page says "Just a moment…" — the API says "help yourself". ~50 unique Discord identities of their verified sellers and customers are tabulated below, captured from endpoints that require literally nothing.
leaked identities — 0x21 verified economy
| username ▲ |
discord id |
account age |
role |
stats |
op notes
Entry path: Cloudflare Turnstile held the front door; a headless-browser solve (FlareSolverr, 14s) produced a cf_clearance that unlocked the entire session for plaintext fetches. Every finding above was collected through that single solved challenge — no exploit, no auth, no breakage. If you're from 0x21 and reading this: put auth checks on the API, gate the blob store behind signed URLs, stop serializing balances into public leaderboards, and maybe don't sell security research tools until your own stack survives a polite GET.