{"id":243,"date":"2014-10-16T08:52:37","date_gmt":"2014-10-16T06:52:37","guid":{"rendered":"https:\/\/hacksecproject.com\/?p=243"},"modified":"2018-11-23T16:59:57","modified_gmt":"2018-11-23T16:59:57","slug":"paypal-authentication-bypass-vulnerability","status":"publish","type":"post","link":"https:\/\/hacksecproject.com\/?p=243","title":{"rendered":"PayPal Merchant Launch Site: Authentication Bypass Vulnerability"},"content":{"rendered":"<p>While most applications require authentication to gain access to private information or to execute tasks, not every authentication method is able to provide adequate security. Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the log in page and directly calling an internal page that is supposed to be accessed only after authentication has been performed.<!--more--><\/p>\n<p> In addition, it is often possible to bypass authentication measures by tampering with requests and tricking the application into thinking that the user is already authenticated. This can be accomplished either by modifying the given URL parameter, by manipulating the form, or by counterfeiting sessions.<\/p>\n<p>In this Write-Up i&#8217;ll describe how i hacked BillMeLater&#8217;s Merchant Launch Site logging into Admin Account exploiting an Authentication Bypass Vulnerability and what this bug allowed me to do once logged in.<\/p>\n<p><strong>Steps required to reproduce the issue:<\/strong><\/p>\n<p>After some DNS-bruteforcing i found this BillMeLater&#8217;s subdomain:<\/p>\n<p><a href=\"https:\/\/launch.billmelater.com\">https:\/\/launch.billmelater.com<\/a><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-270\" src=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo1-300x169.png\" alt=\"\" width=\"1360\" height=\"768\" srcset=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo1-300x169.png 300w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo1-768x434.png 768w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo1-1024x578.png 1024w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo1-1200x678.png 1200w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo1.png 1360w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/p>\n<p>Once clicked on &#8220;Login&#8221; i have been redirected to <a title=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Login\/Default.aspx?returnurl=\/default.aspx\" href=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Login\/Default.aspx?returnurl=\/default.aspx\">https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Login\/Default.aspx?returnurl=\/default.aspx<\/a><br \/>\nso i started playing with this URL deleting &#8220;?returnurl=\/default.aspx&#8221; from the URL above.<br \/>\nSo this is the New URL:<\/p>\n<p><a title=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Login\/Default.aspx\" href=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Login\/Default.aspx\">https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Login\/Default.aspx<\/a><\/p>\n<p>My attention was attracted by the &#8220;Login&#8221; directory so i started to manually fuzz the URL changing &#8220;Login&#8221; with &#8220;Register&#8221;<\/p>\n<p><a title=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Register\/Default.aspx\" href=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Register\/Default.aspx\">https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Register\/Default.aspx<\/a><\/p>\n<p>Once submitted the request i received a &#8220;302&#8221; Status code so the link is accessible only if logged in.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-272\" src=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo2-300x169.png\" alt=\"\" width=\"1360\" height=\"768\" srcset=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo2-300x169.png 300w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo2-768x434.png 768w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo2-1024x578.png 1024w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo2-1200x678.png 1200w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo2.png 1360w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/p>\n<p>So i thought to use a Mozilla Firefox add-on called &#8220;NoRedirect&#8221; to not redirects me to the login page.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-273\" src=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo3-300x169.png\" alt=\"\" width=\"1360\" height=\"768\" srcset=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo3-300x169.png 300w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo3-768x434.png 768w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo3-1024x578.png 1024w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo3-1200x678.png 1200w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo3.png 1360w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/p>\n<p>Now if i go to <a title=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Register\/Default.aspx\" href=\"https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Register\/Default.aspx\" target=\"_blank\" rel=\"noopener\">https:\/\/launch.billmelater.com\/Home\/tabid\/36\/ctl\/Register\/Default.aspx<\/a> i will be logged in as Administrator and i can execute operations like if i were the Administrator.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium wp-image-274\" src=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo4-300x169.png\" alt=\"\" width=\"1360\" height=\"768\" srcset=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo4-300x169.png 300w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo4-768x434.png 768w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo4-1024x578.png 1024w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo4-1200x678.png 1200w, https:\/\/hacksecproject.com\/wp-content\/uploads\/2014\/10\/photo4.png 1360w\" sizes=\"auto, (max-width: 709px) 85vw, (max-width: 909px) 67vw, (max-width: 1362px) 62vw, 840px\" \/><\/p>\n<p>Now the bug has been fixed and here\u2019s a video of the process of exploiting this vulnerability:<\/p>\n<p><iframe loading=\"lazy\" src=\"\/\/www.youtube.com\/embed\/gFNZKoP2D7s?rel=0\" width=\"640\" height=\"360\" frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n","protected":false},"excerpt":{"rendered":"<p>While most applications require authentication to gain access to private information or to execute tasks, not every authentication method is able to provide adequate security. Negligence, ignorance, or simple understatement of security threats often result in authentication schemes that can be bypassed by simply skipping the log in page and directly calling an internal page &hellip; <a href=\"https:\/\/hacksecproject.com\/?p=243\" class=\"more-link\">Leggi tutto<span class=\"screen-reader-text\"> &#8220;PayPal Merchant Launch Site: Authentication Bypass Vulnerability&#8221;<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":19,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-243","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized-en"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>PayPal : Authentication Bypass Vulnerability<\/title>\n<meta name=\"description\" content=\"In this Write-Up i\u2019ll describe how i hacked PayPal Merchant Launch Site logging into Admin Account exploiting an Authentication Bypass Vulnerability.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hacksecproject.com\/?p=243\" \/>\n<meta property=\"og:locale\" content=\"it_IT\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"PayPal : Authentication Bypass Vulnerability\" \/>\n<meta property=\"og:description\" content=\"In this Write-Up i\u2019ll describe how i hacked PayPal Merchant Launch Site logging into Admin Account exploiting an Authentication Bypass Vulnerability.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hacksecproject.com\/?p=243\" \/>\n<meta property=\"article:published_time\" content=\"2014-10-16T06:52:37+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-11-23T16:59:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/hacksecproject.com\/wp-content\/uploads\/2018\/04\/PayPal.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"745\" \/>\n\t<meta property=\"og:image:height\" content=\"559\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Medu554\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Scritto da\" \/>\n\t<meta name=\"twitter:data1\" content=\"Medu554\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tempo di lettura stimato\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minuti\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243\"},\"author\":{\"name\":\"Medu554\",\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/#\\\/schema\\\/person\\\/526444cfaef818c23a7b4e4519573689\"},\"headline\":\"PayPal Merchant Launch Site: Authentication Bypass Vulnerability\",\"datePublished\":\"2014-10-16T06:52:37+00:00\",\"dateModified\":\"2018-11-23T16:59:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243\"},\"wordCount\":343,\"image\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hacksecproject.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/PayPal.jpg\",\"articleSection\":[\"Uncategorized\"],\"inLanguage\":\"it-IT\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243\",\"url\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243\",\"name\":\"PayPal : Authentication Bypass Vulnerability\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/hacksecproject.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/PayPal.jpg\",\"datePublished\":\"2014-10-16T06:52:37+00:00\",\"dateModified\":\"2018-11-23T16:59:57+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/#\\\/schema\\\/person\\\/526444cfaef818c23a7b4e4519573689\"},\"description\":\"In this Write-Up i\u2019ll describe how i hacked PayPal Merchant Launch Site logging into Admin Account exploiting an Authentication Bypass Vulnerability.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243#breadcrumb\"},\"inLanguage\":\"it-IT\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/hacksecproject.com\\\/?p=243\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243#primaryimage\",\"url\":\"https:\\\/\\\/hacksecproject.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/PayPal.jpg\",\"contentUrl\":\"https:\\\/\\\/hacksecproject.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/PayPal.jpg\",\"width\":745,\"height\":559},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/?p=243#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/hacksecproject.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"PayPal Merchant Launch Site: Authentication Bypass Vulnerability\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/#website\",\"url\":\"https:\\\/\\\/hacksecproject.com\\\/\",\"name\":\"\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/hacksecproject.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"it-IT\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/hacksecproject.com\\\/#\\\/schema\\\/person\\\/526444cfaef818c23a7b4e4519573689\",\"name\":\"Medu554\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"it-IT\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/29ba1a61e7548d882dbad311db32d5e08fdc44eee25a59452ea4ac5a94ed80b3?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/29ba1a61e7548d882dbad311db32d5e08fdc44eee25a59452ea4ac5a94ed80b3?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/29ba1a61e7548d882dbad311db32d5e08fdc44eee25a59452ea4ac5a94ed80b3?s=96&d=mm&r=g\",\"caption\":\"Medu554\"},\"url\":\"https:\\\/\\\/hacksecproject.com\\\/?author=2\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"PayPal : Authentication Bypass Vulnerability","description":"In this Write-Up i\u2019ll describe how i hacked PayPal Merchant Launch Site logging into Admin Account exploiting an Authentication Bypass Vulnerability.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hacksecproject.com\/?p=243","og_locale":"it_IT","og_type":"article","og_title":"PayPal : Authentication Bypass Vulnerability","og_description":"In this Write-Up i\u2019ll describe how i hacked PayPal Merchant Launch Site logging into Admin Account exploiting an Authentication Bypass Vulnerability.","og_url":"https:\/\/hacksecproject.com\/?p=243","article_published_time":"2014-10-16T06:52:37+00:00","article_modified_time":"2018-11-23T16:59:57+00:00","og_image":[{"width":745,"height":559,"url":"https:\/\/hacksecproject.com\/wp-content\/uploads\/2018\/04\/PayPal.jpg","type":"image\/jpeg"}],"author":"Medu554","twitter_card":"summary_large_image","twitter_misc":{"Scritto da":"Medu554","Tempo di lettura stimato":"2 minuti"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/hacksecproject.com\/?p=243#article","isPartOf":{"@id":"https:\/\/hacksecproject.com\/?p=243"},"author":{"name":"Medu554","@id":"https:\/\/hacksecproject.com\/#\/schema\/person\/526444cfaef818c23a7b4e4519573689"},"headline":"PayPal Merchant Launch Site: Authentication Bypass Vulnerability","datePublished":"2014-10-16T06:52:37+00:00","dateModified":"2018-11-23T16:59:57+00:00","mainEntityOfPage":{"@id":"https:\/\/hacksecproject.com\/?p=243"},"wordCount":343,"image":{"@id":"https:\/\/hacksecproject.com\/?p=243#primaryimage"},"thumbnailUrl":"https:\/\/hacksecproject.com\/wp-content\/uploads\/2018\/04\/PayPal.jpg","articleSection":["Uncategorized"],"inLanguage":"it-IT"},{"@type":"WebPage","@id":"https:\/\/hacksecproject.com\/?p=243","url":"https:\/\/hacksecproject.com\/?p=243","name":"PayPal : Authentication Bypass Vulnerability","isPartOf":{"@id":"https:\/\/hacksecproject.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/hacksecproject.com\/?p=243#primaryimage"},"image":{"@id":"https:\/\/hacksecproject.com\/?p=243#primaryimage"},"thumbnailUrl":"https:\/\/hacksecproject.com\/wp-content\/uploads\/2018\/04\/PayPal.jpg","datePublished":"2014-10-16T06:52:37+00:00","dateModified":"2018-11-23T16:59:57+00:00","author":{"@id":"https:\/\/hacksecproject.com\/#\/schema\/person\/526444cfaef818c23a7b4e4519573689"},"description":"In this Write-Up i\u2019ll describe how i hacked PayPal Merchant Launch Site logging into Admin Account exploiting an Authentication Bypass Vulnerability.","breadcrumb":{"@id":"https:\/\/hacksecproject.com\/?p=243#breadcrumb"},"inLanguage":"it-IT","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hacksecproject.com\/?p=243"]}]},{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/hacksecproject.com\/?p=243#primaryimage","url":"https:\/\/hacksecproject.com\/wp-content\/uploads\/2018\/04\/PayPal.jpg","contentUrl":"https:\/\/hacksecproject.com\/wp-content\/uploads\/2018\/04\/PayPal.jpg","width":745,"height":559},{"@type":"BreadcrumbList","@id":"https:\/\/hacksecproject.com\/?p=243#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hacksecproject.com\/"},{"@type":"ListItem","position":2,"name":"PayPal Merchant Launch Site: Authentication Bypass Vulnerability"}]},{"@type":"WebSite","@id":"https:\/\/hacksecproject.com\/#website","url":"https:\/\/hacksecproject.com\/","name":"","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hacksecproject.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"it-IT"},{"@type":"Person","@id":"https:\/\/hacksecproject.com\/#\/schema\/person\/526444cfaef818c23a7b4e4519573689","name":"Medu554","image":{"@type":"ImageObject","inLanguage":"it-IT","@id":"https:\/\/secure.gravatar.com\/avatar\/29ba1a61e7548d882dbad311db32d5e08fdc44eee25a59452ea4ac5a94ed80b3?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/29ba1a61e7548d882dbad311db32d5e08fdc44eee25a59452ea4ac5a94ed80b3?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/29ba1a61e7548d882dbad311db32d5e08fdc44eee25a59452ea4ac5a94ed80b3?s=96&d=mm&r=g","caption":"Medu554"},"url":"https:\/\/hacksecproject.com\/?author=2"}]}},"_links":{"self":[{"href":"https:\/\/hacksecproject.com\/index.php?rest_route=\/wp\/v2\/posts\/243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hacksecproject.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hacksecproject.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hacksecproject.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hacksecproject.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=243"}],"version-history":[{"count":8,"href":"https:\/\/hacksecproject.com\/index.php?rest_route=\/wp\/v2\/posts\/243\/revisions"}],"predecessor-version":[{"id":282,"href":"https:\/\/hacksecproject.com\/index.php?rest_route=\/wp\/v2\/posts\/243\/revisions\/282"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hacksecproject.com\/index.php?rest_route=\/wp\/v2\/media\/19"}],"wp:attachment":[{"href":"https:\/\/hacksecproject.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hacksecproject.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hacksecproject.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}