# <![CDATA[Hacking Chess.com and Accessing 50 Million Customer Records]]>

Chess.com mobile API user-lookup returned each user's PHPSESSID, letting an attacker hijack any account including an admin's.

- Payout: Research
- Severity: critical
- Program: Chess.com
- Credited: Sam Curry
- Disclosed: 2020-12-16
- Write-up quality: 7/10
- Original: https://samcurry.net/hacking-chesscom
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-chesscom
- Tags: domain:api domain:mobile impact:ato impact:data-leak impact:privesc kind:research platform:research sev:critical technique:js-analysis vuln:account-takeover vuln:info-disclosure

**Target:** Mobile API endpoint /v1/users on api.chess.com
**Root cause:** The user object returned by the mobile API included the victim's session_id (PHPSESSID) field, exposing the sole session authorization token to any requester.
**Steps:**
1. Intercept Chess.com iOS app traffic through Burp to discover api.chess.com signed requests.
2. Search a username in the app to trigger `GET /v1/users?loginToken=...&username=hikaru&signed=...`.
3. Observe response includes `email` and `session_id` for the target user.
4. Compare session_id across users and against own PHPSESSID cookie to confirm it is the session token.
5. Set the leaked PHPSESSID as a `.chess.com` scoped cookie to hijack the victim's session, including admin.chess.com.
**How found:** Opened the mobile app under Burp for the first time, noticed signed requests to api.chess.com, then clicked around and saw the user-lookup response leaking email; comparing session_id values across users and matching own PHPSESSID revealed the token leak.
**Exploitation:** Attacker uses the mobile app to look up any username, captures the returned session_id, and sets it as their PHPSESSID cookie scoped to .chess.com, gaining the victim's authenticated session including admin dashboard access.
**Escalation:** Chained the info leak with cookie scoping to .chess.com to reach admin.chess.com administrator dashboard using an admin's leaked session.
**Insight:** Mobile API responses often return richer user objects than the web app; diff fields like session_id/tokens across multiple users and correlate with your own cookie to spot credential leakage in profile endpoints.