The first request is to "requesttype=statusreq.json", returning a JSON object, a...

nneonneo on May 17, 2018 | parent | context | favorite | on: LocationSmart Leaked Location Data for All Major U...

The first request is to "requesttype=statusreq.json", returning a JSON object, and the second to "requesttype=locreq" returning XML. On a whim I decided to try and get JSON location data out (I like JSON better anyway), and found that the two formats did not exhibit identical behaviour. On exploring that further, I found the consent bypass bug.

ironjunkie on May 18, 2018 [–]

I'm impressed by the amount of good guesses you had to get there. Good job!