Murmur Inc.
Murmur
A 14-million-account microblogging platform with a Series-B-startup attack surface. Eight attack phases, ten flags, full platform compromise.
The Engagement
Murmur is a Twitter-clone microblogging platform — accounts post "echoes," follow each other, send DMs, and interact through a public GraphQL API. The engineering org has 86 people across SF and Lisbon, ships fast through Drone CI, manages secrets in Vault, and recently raised $42M Series B. Their security team is, charitably, two people. Ten flags chain from an introspectable GraphQL endpoint through OAuth device-flow social engineering, an Elasticsearch DSL injection, ExifTool RCE, DNS-rebinding SSRF, stored XSS into a moderator session, broken function-level access in the admin panel, and finally a Drone CI pipeline injection that drops Vault credentials for total platform takeover. This is the engagement a pentester bills for after one read-through of "we're a Series-B startup."
Background
The brief came in Friday afternoon: "We're closing our Series C in six weeks and the investors want a clean external pentest report. Public API, internal panels, CI/CD pipeline, the works. Don't break anything customers can see. Find everything." Their last pentest was ten months ago, before they migrated to Apollo Server 4, before the moderator team got their own Django app, before Drone CI replaced GitHub Actions. They handed over a /20 of public IPs and a single account on each system. The rest is up to you.
WebRanges are included in Pro+. Get the full platform for $19.99/mo.
Get Pro+Open in dashboardTechniques