# How Did Tons of People Like Me on Tinder?

HTTP request smuggling on Tinder's api.gotinder.com let the researcher splice a forged GET /like request into victims' traffic, forcing hundreds of users to like his profile.

- Payout: $2,500
- Severity: high
- Program: -
- Credited: Mustafa iran
- Disclosed: 2019-11-25
- Write-up quality: 7/10
- Original: https://pastebin.com/E6LMFm2w
- Library page: https://bugbountylibrary.com/r/blog%3Apastebin-com-e6lmfm2w
- Tags: domain:api domain:web impact:integrity kind:bounty platform:blog sev:high tech:rest technique:chained technique:source-review vuln:request-smuggling

**Target:** api.gotinder.com REST API behind a front-end/back-end HTTP stack
**Root cause:** Front-end and back-end disagreed on request boundaries (CL.TE via Transfer-Encoding: chunked + Content-Length), so a smuggled prefix was prepended to the next victim's request.
**Steps:**
1. Send a POST /profile/photos with `Content-Length: 104` and `Transfer-Encoding : chunked` (note the space) containing chunk `9\r\nlocale=tr\r\n0\r\n` followed by a smuggled `GET /like/__BENIM_ID__?locale=en&s_number=799974200 HTTP/1.1` with `X-Ignore: X`.
2. The back-end treats the chunked body as ending at `0`, leaving the GET /like as the start of the next request on the connection.
3. The next victim request on the shared connection is appended, supplying their X-Auth-Token and session headers to complete the smuggled like.
4. Repeat via Burp smuggling extension configured to send only the attack request (no victim requests).
**How found:** Read James Kettle's 2019 request smuggling paper, hypothesized Tinder's multiple apps might be vulnerable to the new class, tested api.gotinder.com, found no obvious cache so pivoted to the GET /like endpoint as the smuggled action.
**Exploitation:** Attacker queues the smuggling payload on the shared front-end connection; each subsequent victim request completes the smuggled GET /like/<attacker_id>, causing the victim's authenticated like to be recorded against the attacker's profile. Scaled to hundreds of likes in minutes.
**Escalation:** Researcher notes it could be escalated to full account takeover (by smuggling other authenticated actions) but Tinder mitigated within hours before that was demonstrated.
**Insight:** When smuggling against a JSON API, look for state-changing GET endpoints (like /like/<id>) that need minimal headers — they let the victim's own auth complete the smuggled request, turning a parser desync into an authenticated action on the attacker's behalf.