# Spear texting via parameter injection

Third-party SMS link API accepted attacker-controlled redirect URLs in the data JSON, letting the researcher send branded spear-text phishing links to any phone number.

- Payout: $900
- Severity: medium
- Program: -
- Credited: Kyle
- Disclosed: 2019-09-29
- Write-up quality: 6/10
- Original: https://b3nac.com/posts/2019-09-02-Spear-Texting-Via-Parameter-Injection.html
- Library page: https://bugbountylibrary.com/r/blog%3Ab3nac-com-posts-2019-09-02-spear-texting-via-parameter-injection-html
- Tags: domain:api domain:web impact:integrity kind:bounty platform:blog sev:medium tech:rest technique:recon technique:source-review vuln:business-logic vuln:open-redirect

**Target:** Third-party SMS/link-generation API (POST /v1/url) and internal SMS send endpoint
**Root cause:** The link-generation API trusted the client-supplied `data` JSON, including per-platform redirect URLs (desktop/android/ios/fallback), without validating that destinations belonged to the company. The generated link was then sent via SMS under the company's account.
**Steps:**
1. Proxy the site's POST /v1/url request in Burp; note `data` JSON with `android`/`desktop`/`ios`/`fallback` URL fields and the company `key`.
2. Read the third-party API docs to learn each platform field controls the redirect target.
3. Modify `data` to set `"desktop":"http://www.example.com","android":"http://www.example.com","ios":"http://www.example.com","fallback":"http://www.example.com"`.
4. Forward the modified POST /v1/url, then trigger the internal SMS endpoint `sdk=...&phone=<victim>&key=...` to deliver the crafted link.
5. Confirm the SMS arrives with the attacker-controlled link and clicking it redirects to example.com on all platforms.
**How found:** Firefox devtools showed a GET to an external API; following the flow revealed a POST to a third-party link API with the company key and a `data` JSON, then a second internal request with a `phone` parameter. Hypothesis: if the link data is client-controlled, the SMS will carry an attacker link. Reading the vendor docs confirmed per-platform redirect fields.
**Exploitation:** Attacker with the public API key crafts a link whose per-platform redirect points to an arbitrary URL, then uses the internal SMS endpoint to send it to any phone number under the company's name, producing a cross-platform spear-text phishing message.
**Escalation:** Extended a single-platform (android) redirect into a cross-platform (desktop/android/ios/fallback) redirect by reading API docs, raising impact from low to a phishing vector and earning the bounty.
**Insight:** When a site proxies to a third-party link/SMS/notification API, inspect the JSON payload for URL fields the vendor documents as redirect targets; vendor docs often reveal per-platform override fields that widen a single-platform bug into a full phishing vector.