Reverse Engineering for Dummies: The “what if?” User

Micah Parks explores the "what if?" user, someone who uses a product in ways its builders did not intend, such as spotting an embedded key or an unprotected endpoint. He revisits three older, low-stakes projects where he took that role, then advises the tech lead on fixes.

The first case is an Android word game built with Unity. Extracting its word list from the game's data file let him build a solver that beat his partner, and he suggested obfuscation or license checks as optional hardening. The second is a waitlist for exercise equipment. A resale listing exposed a direct product link, and scraping predictable, sequential URLs revealed other waitlisted items. He recommended random identifiers, rate limits and a web application firewall.

The third case involves an auction site whose real-time messaging feed sent every visitor the top bids of all bidders, along with some personal data, because subscriber keys and channels were too broadly scoped. That information would let a seller capture maximum bids. Takeaways include limiting channels to what each user needs, keeping sensitive fields off the client, and reviewing console output before deployment.