# Lack of rate limiting on get.uber.com leads to enumeration of promotion codes and estimation of a lower bound on the number of Uber drivers

No rate limiting on get.uber.com/invite allowed enumeration of 5-char invite codes, leaking account existence and first names and estimating driver count.

- Payout: $3,000
- Severity: medium
- Program: Uber
- Credited: ddworken
- Disclosed: 2016-08-12
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/125200
- Library page: https://bugbountylibrary.com/r/h1%3A125200
- Tags: domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium technique:recon vuln:access-control vuln:info-disclosure

**Target:** get.uber.com invite landing page
**Root cause:** Invite-code lookup endpoint returns distinct responses for valid vs invalid codes and lacks rate limiting, making the 36^5 keyspace enumerable.
**Steps:**
1. Request `https://get.uber.com/invite/v1m8a` (invalid) and `https://get.uber.com/invite/v1m8u` (valid) and compare responses.
2. Valid code returns `Sign up now to claim your free gift from [First Name] ($15 off first ride)*`; invalid returns only `Create your account and get moving in minutes.`
3. Iterate over the 36^5 = 60,466,176 lowercase-alphanumeric codes, checking for the `free gift from` string.
4. Extrapolate from a sampled subset (e.g. 1M codes) to estimate total valid codes.
**How found:** Noticed the invite page returns two distinguishable messages depending on whether the code maps to an account, then reasoned about the small 5-char keyspace and absence of throttling.
**Exploitation:** Scripted HTTP requests to the invite endpoint with no rate limit; each valid code reveals account existence and the associated first name, and sampling estimates the number of drivers.
**Insight:** Short, low-entropy identifiers exposed on public landing pages with binary valid/invalid responses are enumerable; sample a subset and extrapolate rather than brute-forcing the full keyspace.