Account Takeover

​
​
​
​
​Account takeover worth $$$$ 1. Created account on website using test mail id 2. Upload private document like resume and photos 3. Same site having android app > Created account using same mail id but different password 4. Boom account created and able to see private documents​
​#bugbounty I Was able to bypass the Filter on OAUTH through FUZZ With URL-Encode Chars , Found that Website Add / before %5b when redirect the token Example : target/oauth?redirect_uri=http://attacker.com%https://t.co/QSv7Vm2STd Redirect Token to : http://Attacker.com/%5b.target.comrget.com?token=…...​
​I was testing for ATO via reset function . Tried all method but no success. My [email protected] gave me tip to add double Host in request while requesting password Host: http://site.com Host: http://evilsite.com Boom it worked​
​
https://twitter.com/chiraggupta8769/status/1297102892135063552?s=20
​
​
Authentication / Authorization
Application Login
Last modified 2yr ago