“Day 30: The Finale — The Bug That Almost Broke the Internet (Or Just My Testing Account)”
一位开发者在测试无服务器平台时,因API调用参数错误触发了1000多个虚拟服务器启动,导致2.5万美元云账单和账户被封。平台随后奖励7500美元漏洞赏金并恢复访问。 2025-9-8 11:2:21 Author: infosecwriteups.com(查看原文) 阅读量:9 收藏

How a Simple API Call Triggered a $25,000 Cloud Bill and a Temporary Ban

Aman Sharma

Well, folks, we’ve reached Day 30. It’s been a wild ride, and I’ve saved one of my most memorable stories for last. This wasn’t just a bug; it was a digital avalanche. The target was a new “serverless” platform promising effortless auto-scaling. My goal was to test its limits. I found an API endpoint that managed background workers. A simple miscalculation with a parameter — a number that was too big — unleashed a chain reaction. Within minutes, their system had spun up over 1000 virtual servers to handle my request, triggering a massive cloud bill and automatic alerts that got my testing account instantly banned. The vendor was initially furious, but after understanding the flaw, they awarded a $7,500 bounty and reinstated my access. This is the story of the day I (accidentally) stress-tested the cloud.

free link

The Peril of “Unlimited” Scale

Cloud platforms and serverless architectures promise infinite, automatic scaling. This is powerful for developers but creates a terrifying attack vector: resource exhaustion. The question isn’t just “can I access data?” but “can I make…


文章来源: https://infosecwriteups.com/day-30-the-finale-the-bug-that-almost-broke-the-internet-or-just-my-testing-account-d63112e13427?source=rss----7b722bfd1b8d--bug_bounty
如有侵权请联系:admin#unsafe.sh