Subscribe For Free Updates!

We'll not spam mate! We promise.

Saturday, August 24, 2019

From Github Recon To Account Takeover

Hi everyone , after a long time I am doing a write-up on GitHub recon which leads to full account takeover . Few days ago I got a private invite where the in-scope target is only the mobile app.

As its a private program we will take it as Example App . So I gone through all endpoint and functionality of the  application , i didn't find anything critical. So I thought to give a try to their GitHub.

If you want to learn how to do GitHub recon there is a detailed tutorial by Th3G3nt3lman


So i started my search with the keyword passwd , i got 3-5 result 

after going through all file i got a valid password in file called config.properties


 So that app using OTP based authentication and i got the credential for the third party service , which they are using for the SMS.

Using those credential I logged into the SMS provider portal , there is a section call SMS delivery where all SMS delivery report are  stored along with the Phone number and the text sent to that number.



So now i have all registered users mobile number and OTP delivery report along with OTP


So i just request for OTP and from the delivery report got the valid OTP and loggedin to any user's account 😎


 Hope you guys like it , share your feedback in commen. 




 

7 comments:

Sonali said...

How you found that password🤔..
Don't know the tricks,but its intresting...

THE ONLY TRUE HACKER IN THE WORLD ® said...

INSTEAD OF GETTING A LOAN,, I GOT SOMETHING NEW
Get $5,500 USD every day, for six months!

See how it works
Do you know you can hack into any ATM machine with a hacked ATM card??
Make up you mind before applying, straight deal...

Order for a blank ATM card now and get millions within a week!: contact us
via email address::{Universalcardshackers@gmail.com}

We have specially programmed ATM cards that can be use to hack ATM
machines, the ATM cards can be used to withdraw at the ATM or swipe, at
stores and POS. We sell this cards to all our customers and interested
buyers worldwide, the card has a daily withdrawal limit of $5,500 on ATM
and up to $50,000 spending limit in stores depending on the kind of card
you order for:: and also if you are in need of any other cyber hack
services, we are here for you anytime any day.

Here is our price lists for the ATM CARDS:

Cards that withdraw $5,500 per day costs $200 USD
Cards that withdraw $10,000 per day costs $850 USD
Cards that withdraw $35,000 per day costs $2,200 USD
Cards that withdraw $50,000 per day costs $5,500 USD
Cards that withdraw $100,000 per day costs $8,500 USD

make up your mind before applying, straight deal!!!

The price include shipping fees and charges, order now: contact us via
email address:: {Universalcardshackers@gmail.com}

Gary said...
This comment has been removed by a blog administrator.
URGENT LOAN OFFER WHATSAPP +918929509036 said...

Are you tired of seeking loans and Mortgages,have you been turned down constantly By your banks and other financial trial will convince you.What are your Financial needs?Do you need a business loan?Do you need a personal loan?Do you want to buy a car?Do you want to refinance?Do you need a mortgage loan?Do you need a huge capital to start off your business proposal or expansion? Have you lost hope and you think there is no way out, and your financial burdens still persists? Contact us (fastloanoffer34@gmail.com) Your Name:............... Your Country:............... Your Occupation:............... Loan Amount Needed:............... Loan Duration............... Monthly Income:............... Your Telephone Number:..................... Business Plan/Use Of Your Loan:............... Contact Us At : fastloanoffer34@gmail.com Phone number :+918929509036

clem said...

Hello Everybody,
My name is Ahmad Asnul Brunei, I contacted Mr. Alpha Loan Firm for a business loan amount of $250,000, Then i was told about the step of approving my requested loan amount, after taking the risk again because i was so much desperate of setting up a business to my greatest surprise, the loan amount was credited to my bank account within 24 banking hours without any stress of getting my loan. I was surprise because i was first fall a victim of scam! If you are interested of securing any loan amount & you are located in any country, I'll advise you can contact Mr. Alpha Loan Firm via Email call or add us on what's app+91-9818603391 Contact Us At : clemalphafinance@gmail.com

Blogger said...

As stated by Stanford Medical, It is really the ONLY reason this country's women get to live 10 years more and weigh 19 KG lighter than we do.

(Just so you know, it is not related to genetics or some secret diet and EVERYTHING related to "HOW" they are eating.)

BTW, What I said is "HOW", not "WHAT"...

CLICK this link to discover if this easy test can help you unlock your true weight loss potential

Shron Prysock said...

BEST WAY TO HAVE GOOD AMOUNT TO START A GOOD BUSINESS or TO START LIVING A GOOD LIFE….. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (williamshackers@hotmail.com) or WhatsApp +27730051607. for how to get it and its cost . ………. EXPLANATION OF HOW THESE CARD WORKS………. You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT $200, $300, $400, $1,000, 2nd VAULT $2000, $3000, $4000, $5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done. ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. email (williamshackers@hotmail.com) or WhatsApp +27730051607.