# Reading redacted data via hackbot's answers

HackerOne's hackbot similarity scoring compared against redacted text, letting attackers brute-force hidden redacted values by submitting reports and reading match percentages.

- Payout: $1,500
- Severity: medium
- Program: HackerOne
- Credited: inhibitor181
- Disclosed: 2017-07-27
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/247628
- Library page: https://bugbountylibrary.com/r/h1%3A247628
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium tech:rest technique:blind vuln:info-disclosure

**Target:** hackbot duplicate-detection similarity oracle on report submission
**Root cause:** The duplicate-detection bot computes similarity against the original unredacted report content instead of the redacted version, leaking the hidden text through the match percentage.
**Steps:**
1. Create a test program and submit a report with content `testredact password is 123456789`.
2. As admin, redact `123456789` in the report.
3. As another user, submit a new report mimicking the redacted one with guessed content, e.g. `testredact password is 123456xxx`.
4. Read hackbot's similarity percentage (78% for wrong guess).
5. Iterate guesses (`123456781` -> 88%, `123456789` -> 100%) to recover the redacted value.
**How found:** Researcher noticed hackbot matched duplicate reports using the real redacted text rather than the blacked-out placeholder, then tested whether similarity percentages could be used to infer hidden content.
**Exploitation:** Attacker submits candidate reports and uses the returned similarity percentage as an oracle to brute-force the redacted secret character by character until 100% match confirms the hidden value.
**Insight:** Any similarity/diff scoring feature that compares against pre-redaction content becomes an oracle; test whether redaction is applied before or after comparison logic runs.