Home Top Ad

Responsive Ads Here

From Github Recon To Account Takeover

Share:
Hi everyone , after a long time I am doing a write-up on GitHub recon which leads to full account takeover . Few days ago I got a private invite where the in-scope target is only the mobile app.

As its a private program we will take it as Example App . So I gone through all endpoint and functionality of the  application , i didn't find anything critical. So I thought to give a try to their GitHub.

If you want to learn how to do GitHub recon there is a detailed tutorial by Th3G3nt3lman


So i started my search with the keyword passwd , i got 3-5 result 

after going through all file i got a valid password in file called config.properties


 So that app using OTP based authentication and i got the credential for the third party service , which they are using for the SMS.

Using those credential I logged into the SMS provider portal , there is a section call SMS delivery where all SMS delivery report are  stored along with the Phone number and the text sent to that number.



So now i have all registered users mobile number and OTP delivery report along with OTP


So i just request for OTP and from the delivery report got the valid OTP and loggedin to any user's account 😎


 Hope you guys like it , share your feedback in commen. 




 

9 comments

Sonali said...

How you found that password🤔..
Don't know the tricks,but its intresting...

THE ONLY TRUE HACKER IN THE WORLD ® said...

INSTEAD OF GETTING A LOAN,, I GOT SOMETHING NEW
Get $5,500 USD every day, for six months!

See how it works
Do you know you can hack into any ATM machine with a hacked ATM card??
Make up you mind before applying, straight deal...

Order for a blank ATM card now and get millions within a week!: contact us
via email address::{Universalcardshackers@gmail.com}

We have specially programmed ATM cards that can be use to hack ATM
machines, the ATM cards can be used to withdraw at the ATM or swipe, at
stores and POS. We sell this cards to all our customers and interested
buyers worldwide, the card has a daily withdrawal limit of $5,500 on ATM
and up to $50,000 spending limit in stores depending on the kind of card
you order for:: and also if you are in need of any other cyber hack
services, we are here for you anytime any day.

Here is our price lists for the ATM CARDS:

Cards that withdraw $5,500 per day costs $200 USD
Cards that withdraw $10,000 per day costs $850 USD
Cards that withdraw $35,000 per day costs $2,200 USD
Cards that withdraw $50,000 per day costs $5,500 USD
Cards that withdraw $100,000 per day costs $8,500 USD

make up your mind before applying, straight deal!!!

The price include shipping fees and charges, order now: contact us via
email address:: {Universalcardshackers@gmail.com}

Gary said...
This comment has been removed by a blog administrator.
URGENT LOAN OFFER WHATSAPP +918929509036 said...

Are you tired of seeking loans and Mortgages,have you been turned down constantly By your banks and other financial trial will convince you.What are your Financial needs?Do you need a business loan?Do you need a personal loan?Do you want to buy a car?Do you want to refinance?Do you need a mortgage loan?Do you need a huge capital to start off your business proposal or expansion? Have you lost hope and you think there is no way out, and your financial burdens still persists? Contact us (fastloanoffer34@gmail.com) Your Name:............... Your Country:............... Your Occupation:............... Loan Amount Needed:............... Loan Duration............... Monthly Income:............... Your Telephone Number:..................... Business Plan/Use Of Your Loan:............... Contact Us At : fastloanoffer34@gmail.com Phone number :+918929509036

clem said...

Hello Everybody,
My name is Ahmad Asnul Brunei, I contacted Mr. Alpha Loan Firm for a business loan amount of $250,000, Then i was told about the step of approving my requested loan amount, after taking the risk again because i was so much desperate of setting up a business to my greatest surprise, the loan amount was credited to my bank account within 24 banking hours without any stress of getting my loan. I was surprise because i was first fall a victim of scam! If you are interested of securing any loan amount & you are located in any country, I'll advise you can contact Mr. Alpha Loan Firm via Email call or add us on what's app+91-9818603391 Contact Us At : clemalphafinance@gmail.com

Blogger said...

As stated by Stanford Medical, It is really the ONLY reason this country's women get to live 10 years more and weigh 19 KG lighter than we do.

(Just so you know, it is not related to genetics or some secret diet and EVERYTHING related to "HOW" they are eating.)

BTW, What I said is "HOW", not "WHAT"...

CLICK this link to discover if this easy test can help you unlock your true weight loss potential

Shron Prysock said...

BEST WAY TO HAVE GOOD AMOUNT TO START A GOOD BUSINESS or TO START LIVING A GOOD LIFE….. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (williamshackers@hotmail.com) or WhatsApp +27730051607. for how to get it and its cost . ………. EXPLANATION OF HOW THESE CARD WORKS………. You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT $200, $300, $400, $1,000, 2nd VAULT $2000, $3000, $4000, $5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done. ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. email (williamshackers@hotmail.com) or WhatsApp +27730051607.

Fixit said...

Hello all
am looking few years that some guys comes into the market
they called themselves hacker, carder or spammer they rip the
peoples with different ways and it’s a badly impact to real hacker
now situation is that peoples doesn’t believe that real hackers and carder scammer exists.
Anyone want to make deal with me any type am available but first
I‘ll show the proof that am real then make a deal like

Available Services

..Wire Bank Transfer all over the world

..Western Union Transfer all over the world

..Credit Cards (USA, UK, AUS, CAN, NZ)

..School Grade upgrade / remove Records

..Spamming Tool

..keyloggers / rats

..Social Media recovery

.. Teaching Hacking / spamming / carding (1/2 hours course)

discount for re-seller

Contact: 24/7

fixitrogers@gmail.com

Hussain Al-Saidely said...

Borrow money here today at 3% interest rate. Sawda Capital Finance offers all kinds of financial services of all sizes ranging from individuals, companies, and traders globally./Our services are 100% guaranteed and risk-free.

We build just the right financing for each client, with simple paperwork, quick approvals, and flexible payment schedules. For further details, Kindly contact us via email At sawda.finance@gmail.com

Intermediaries/Consultants/Brokers are welcome to bring their clients and are 100% protected. In complete confidence, we will work together for the benefits of all parties involved, Looking forward to rendering the best of our services to all esteemed clientele globally.