Showmax is a streaming service that offers a wide variety of award-winning TV shows, movies, anime, documentaries,

After i saw a disclosed report in Twitter by @lordjerry0x01 https://hackerone.com/reports/1077520
I said wawww , 2000$. for parental pin bypass , let me bypass the pin too As i have the same flow of @zseano, i hack the main app

The game begin

I started by create an account then clicking in each button to understand how the app works
after a few minute i found the parental control endpoint , now i added a code pin in kids profile so that, kids who dont has 18+ can’t watch adults serie

when browsing my burp history , i have found this https://www.showmax.com/eng/parentalControlForm/%2Fhome/true

i decide to take a look this url , because most of the time you can bypass the protecting by changing from True to false , false to true

when i copied and paste the url in kids profile , its disclose the parental pin

1. login in to your showmax account
2. add parental pin
3. Go to https://www.showmax.com/eng/home
4. click watch triller
5. you will asked for parental pin
6. enter this url in your brower https://www.showmax.com/eng/parentalControlForm/%2Fhome/true
7. you will get the parental pin without confirming your password
8. now you change the parental pin , and you can bypass the password confirmation , for parental control

here the disclosed report https://hackerone.com/reports/1121169

thank you for taking your time to my report

you can found me in twitter https://twitter.com/moodiAbdoul