In the summer of 2013, a client of ours was being held ransom by a “whitehat” hacker demanding $250,000 within 48 hours or they would reveal the exploit. The hacker had demonstrated an ability to change the password for any account in the company’s web application at will, thus taking control of any account. In this case owning an account gave the direct ability for the attacker to transfer money using the victim’s credit card or bank account. Worse yet, the attack was completely undetected, all logs showed normal activity and none of WAF/IPS/IDS solutions were being triggered. Unable to track down the issue with no sign of attack in the logs, the client hired MassiveLabs to discover the issue. Although many modes of possible exploitation were considered, including installing key loggers on client workstations, exploitation of vulnerable servers to pivot to the effected app, etc., Four other security firms were working on the same problem, but we at MassiveLabs elected to focus on black box testing of the web applications logic itself. This route proved successful, with MassiveLabs discovering a vulnerability in the first 12 hours of testing on a sister site which shared the same account store. The vulnerability allowed a password reset to occur if the security question fields were simply omitted from the post request on the forgot password form. The team at MassiveLabs took the findings to the client, who quickly remediated the issue that night, and wrapped up the engagement. Embarrassing oversight, quick fix, and everyone’s weekend was saved, almost. The next day the hacker responded by changing the account password of the clients account in their application again. MassiveLabs went back to the drawing board and discovered, yet another vulnerability in web logic. This issue, however, proved to be much more difficult to discover, much more esoteric, error in the server side code. The error demonstrated the scope of potential unexpected behavior in web applications and highlights the difficulty of detecting and preventing the introduction of these issues.