How i hacked your Badoo's Account

Hey everyone out there ! Today i wanna share my finding of Badoo.com from which i can takeover anyone account by just giving him/her a poisionous link ūüėÜ



Badoo is a dating-focused[3] social networking service, founded in 2006[4]and headquarters in Soho, London. The site operates in 180 countries[5] and is most popular in Latin America, Spain, Italy and France.[6] Badoo ranks as the 281st most popular website in the world, according to Alexa Internet as of April 2014. The site operates on a freemiummodel. To gain extra features, a user can pay a fee or allow Badoo to email all his/her friends.

Lets start ;)

Firstly i wanna thank my friend Rudra who always encourage me :-) He given me a simple link and i took out an account takeover from it ūüėą

The bug was really very simple, it works on a CSRF & A token missconfiguration. And only valid for https://m.Badoo.com

When we import photos from Facebook or Instagram it do not have any anti-CSRF token, the Facebook token which generated via Badoo is valid for everyuser. Now i can give a link to a user of my fb account to import photos, if user will press okay then photo will be imported to his account.

But how i got an takeover here ?

The thing i noticed that the link generated is also replace the user FB linked account with attacker's FB account and the best part was user just need to visit link no cancel or okay pressing required.ūüėõ

Now an attacker can login via FB and fully takeover the account and can access all his chat, private photos and everything ūüėā

The bug is patched within 2 days of intial report. Reward ($850) was pretty less from my expectation ūüė•.

Steps to reproduce was :-

1 -Create two Badoo account attacker & victim and link 2 diff fb account in each of them

2- Login as 'attacker' and go to import photos via fb and copy the link from URL bar

3- Now login as 'victim' in diffrent browser and open the link and click cancel.

4- FB account of 'victim' is replaced with FB account of 'attacker' (Removed from 'attacker' one)

5-Login via attacker's FB account and you will be logged in as 'victim' account

Congo u just hacked victim account

More explanation

Suppose a user have an account of attacker 'A' with FB linked which 'FB-of-A' and a victim account 'B' with fb linked which is 'FB-of-B' now attacker create a link to import photos from his fb and give it to victim 'B' he opens it and press cancel but this have changed his FB account 'FB-of-B' to attacker's FB account 'FB-of-A', And now attacker can login with his fb account in victim's badoo account.


I can chat with my victim on Badoo and can have hacked his/her account in 5 minutes ūüėĚ

PoC


https://youtu.be/xylkmN_IRF0

Bug Timeline 

09 March : Reported
10 March : Bounty Rewarded
11 March : Bug patched

31 comments:

  1. Replies
    1. I'm an EC council certified hacker, that speaks for itself. Feel free to contact me on "jp.morgan@greenmail.net". You can reach out to me for any hack related exploit and I'll write you a quote within 24hrs alongside details on mode of operation.
      I'm also open to review scam victims so as to help them recover their stolen funds.

      Knowledge speaks, but wisdom listens.
      Jimi Hendrix

      Delete
    2. BE SMART AND BECOME RICH IN LESS THAN 3DAYS....It all depends on how fast you can be to get the new PROGRAMMED blank ATM card that is capable of hacking into any ATM machine,anywhere in the world. I got to know about this BLANK ATM CARD when I was searching for job online about a month ago..It has really changed my life for good and now I can say I'm rich and I can never be poor again. The least money I get in a day with it is about $50,000.(fifty thousand USD) Every now and then I keeping pumping money into my account. Though is illegal,there is no risk of being caught ,because it has been programmed in such a way that it is not traceable,it also has a technique that makes it impossible for the CCTVs to detect you..For details on how to get yours today, email the hackers on : (marklizzy064@gmail.com). Tell your loved once too, and start to live large. That's the simple testimony of how my life changed for good...Love you all ...the email address again is (marklizzy064@gmail.com) Whats App or call +27742300409

      Delete
    3. Can someone back my fellas for me as I not sure how .

      Delete
  2. the video was filtered can you upload again? thanks

    ReplyDelete
  3. Technology has empowered everybody..its really as big as you can make it
    and goes as far as you can take it..People are getting in contact with
    hackers to help them predict the stock market,clear student loans,expunge
    criminal records,upgrade university grades,bank accounts and other
    debts,fix credit ratings,double your tax return and help hack business
    competitors..contact hackempire007@gmail.com
    You need a savvy hacker though,one who
    would be able to carry out and successfully execute hacks on your behalf
    while keeping it all discrete and under the radar.

    ReplyDelete
  4. Hello am Carla,have been a victim of scam several times.until i came across ispyhacks@gmail.com he helped me hack all my husbands
    social netwrok and i finally found out he was cheating on me with another woman thanks to ispyhacks@gmail.com his job is 100% ledgit
    and affordable. if you need him, his always avaliable.

    ReplyDelete
    Replies
    1. PLEASE READ!!!! Hello Guys,This is a Life Time transformation !!!Am so happy I got mine from Elizabeth. My blank ATM card can withdraw $2,000 daily. I got it from Her last week and now I have $8,000 for free. The blank ATM withdraws money from any ATM machines and there is no name on it, it is not traceable and now i have money for business and enough money for me and my family to live on .I am really happy i met Elizabeth because i met two people before her and they took my money not knowing that they were scams. But am happy now. Elizabeth sent the card through DHL and i got it in two days. Get your own card from her now she is not like other scammer pretending to have the ATM card,She is giving it out for free to help people even if it is illegal but it helps a lot and no one ever gets caught. im grateful to Elizabeth because she changed my story all of a sudden . The card works in all countries except Philippines, Mali and Nigeria. Elizabeth's email address is elizabethcole232@yahoo.com

      Delete
  5. You need a savvy hacker,one who specializes in Expunging Criminal Records and Change of University Grades. Contact savvyhackers@gmail.com One who would be able to carry out and successfully execute hacks on your behalf while keeping it all discrete and under the radar.

    ReplyDelete
    Replies
    1. PLEASE READ!!!! Hello Guys,This is a Life Time transformation !!!Am so happy I got mine from Elizabeth. My blank ATM card can withdraw $2,000 daily. I got it from Her last week and now I have $8,000 for free. The blank ATM withdraws money from any ATM machines and there is no name on it, it is not traceable and now i have money for business and enough money for me and my family to live on .I am really happy i met Elizabeth because i met two people before her and they took my money not knowing that they were scams. But am happy now. Elizabeth sent the card through DHL and i got it in two days. Get your own card from her now she is not like other scammer pretending to have the ATM card,She is giving it out for free to help people even if it is illegal but it helps a lot and no one ever gets caught. im grateful to Elizabeth because she changed my story all of a sudden . The card works in all countries except Philippines, Mali and Nigeria. Elizabeth's email address is elizabethcole232@yahoo.com

      Delete
  6. This comment has been removed by the author.

    ReplyDelete
  7. This makes me think of myself. No one should ever accept deceit in the name of love.
    About 3 years ago my WIFE started acting strange and I became suspicious,
    a friend of mine referred me to this guy wonderloop@job4u.com
    He helped me hack my wife's WHATSAPP, FACEBOOK, AND BADOO account and I got to find out that she had another MAN in Canada apparently.
    I was deceived for that long I would not like to see anyone go through such.
    My advice is to contact wonderloop@job4u.com the hack process is so cheap and affordable he his so reliable...

    ReplyDelete
  8. I have my ATM card already programmed to withdraw the maximum of $ 4,000 a day for a maximum of 20 days. I'm so happy with this because I got mine last week and I've used it to get $ 44,000. Mr Martins is giving the card just to help the poor and needy even though it is illegal but it is something nice and it is not like another scam pretending to have the ATM cards blank. And no one gets caught when using the card. Get yours today by sending a mail to martinshackers22@gmail.com.... THIS IS 100% REAL. I AM A BENEFICIARY OF THIS. HACKERS EMAIL: martinshackers22@gmail.com

    ReplyDelete
  9. Are you suffering financially? or do you need urgent cash to pay your bills, or for medications worry no more because there is away you can solve all your problems without stress.You can change your life in just in short period of time. contact (unlimited hackers) for a blank [ATM SMART CARD] today and be among the lucky ones who are benefiting from this cards. I am a living tesitomy, i aslo applied for this card a month ago and now i have mine. This PROGRAMMED blank ATM SMART card is capable of hacking into any ATM machine,anywhere in the world. I got to know about this BLANK ATM CARD when I was searching for a loan lender online about a month ago..It has really changed my life for good and now I can take of my family. The least money I get in a day with this card is about 5000. Everyday i have enough money to take care of my family. Though i was told is illegal, i am very careful there is no risk of being caught, because it has been programmed in such a way that it is not traceable, and also it renders the CCTV useless when you are withdrawing money..For details on how to get a card today, email the hackers on this email: unlimitedhackersnetwork@gmail.com

    ReplyDelete
  10. Have you paid your necessary BILLS? Do you need money? Do you want a better way to transform your own life? My name is Walton Ford. I am here to share with you about Mr MORGAN WEBB new systems of making others rich with not less than two to three days.I was in search of a job opportunity on the internet when i eat across his aid on blogs that i was on BLANK ATM CARD and how he can still give out a LOAN in 2% interest rate.I thought it was a scam or normal gist but I never had a choice to contact him I need you to get the card, and I do not need to give You the card. My friends, today I am a sweet happy man with a good business and a happy family. I charge you not to live by ignorance.Try and Get an ATM card today through (MORGAN WEBB) and be among the lucky ones who are benefiting from this card. This ATM card is capable of hacking into any ATM anywhere in the world.It has really changed my life forever and now I can say I am rich because I am living testimony. The less money I get in a day with this card is $ 3,000.Every now and then money keep pumping into my account. Although it is illegal, there is no risk of being caught, as it is programmed so that it can not track, but also has a technique that makes it impossible for the CCTV to detect you .. I urge you to contact him either on the BLANK ATM CARD or a LOAN at 2% interest rate.For details on how to get yours today, email hackers: morganwebbhack@gmail.com

    ReplyDelete
  11. PLEASE READ!!!
    Celebrate this season with joy and gladness in your heart, Do you know

    that you can hack any ATM machine? this is a Life Time transformation I

    have being hearing about this blank ATM card for a while and i never

    really paid any interest to it because of my doubts. Until now i

    discovered a hacking MAN called STEVE MONEY . Am so happy I got mine from

    STEVE, My blank ATM card can withdraw $4,000 daily. I got it from Her last

    week and now I have $48,000 for free. The blank ATM withdraws money from

    any ATM machines and there is no name on it, it is not traceable and now i

    have money for business and enough money for me and my family to live on

    .I am really happy i met STEVE MONEY because i met two people before her

    and they took my money not knowing that they were scams. But am happy now.

    STEVE sent the card through DHL and i got it in two days. Get your own

    card from her now she is not like other scammer pretending to have the ATM

    card,She is giving it out for free to help people even if it is illegal

    but it helps a lot and no one ever gets caught. im grateful to Engr STEVE

    because she changed my story all of a sudden . The card works in all

    countries

    Gmial: onlineatmhacker@gmail.com

    Yahoomail: onlineatmhacker@yahoo.com

    cellphone: +13869516900

    ReplyDelete
  12. Bonjour tout le monde, mon nom est Mlle Patricia Lucas Moore et qui veulent partager mon t√©moignage sur la fa√ßon dont j'ai obtenu mon BLANK carte de guichet automatique qui ont changer ma vie aujourd'hui. et √©tait autrefois vivant dans la rue o√Ļ par les choses √©taient si difficiles pour moi, m√™me pour payer mes factures a √©t√© tr√®s difficile pour moi et je dois garer hors de ma maison et commencer √† dormir dans la rue de Las Vegas. J'ai essay√© tout ce que je pouvais faire pour obtenir un emploi, mais tout est all√© en vain parce que j'√©tais du c√īt√© noir d'Am√©rique. ont et d√©cid√© de naviguer √† travers sur mon t√©l√©phone pour l'emploi en ligne o√Ļ je suis une annonce sur la publicit√© Les pirates informatiques et carte de guichet automatique vierge qui peut √™tre utilis√© pour pirater tout distributeur automatique de billets dans le monde entier, et n'a jamais pens√© que cela pourrait √™tre vrai parce que l'annonce de pont sur la Internet sont bas√©es sur la fraude, et ont d√©cid√© de donner √† ce essayer et regarder o√Ļ il va me conduire √† si elle peut changer ma vie pour le bien. et a contact√© ces pirates et ils me dit qu'ils sont de l'Australie et ils ont aussi la branche partout dans le monde et qu'ils utilisent dans le d√©veloppement il y a cartes de guichet automatique, ce qui est r√©el et pas une arnaque, il a me aider. de couper l'histoire courte cette femme qui √©taient geeks et aussi des experts √† des r√©parations ATM, la programmation et l'ex√©cution qui m'a appris plusieurs trucs et astuces sur la rupture dans un distributeur automatique avec un card.i ATM vierge appliqu√©e pour la carte ATM vierge et il a √©t√© livr√© pour moi dans les 3 jours et je l'ai fait ce qu'on m'a dit cela et aujourd'hui ma vie ont le changement d'une rue Walker √† ma maison, il n'y a pas de machines ATM cette BLANK CARTE ATM ne peut pas p√©n√©trer dans parce qu'il a √©t√© programm√© avec divers outils et logiciels avant d'√™tre envoy√©s √† vous. ma vie a vraiment changer et je veux partager au monde, et de savoir ce qui est ill√©gal, mais aussi une fa√ßon intelligente de vivre Big parce que le gouvernement ne peut pas nous aider car nous devons aider notre auto. si vous voulez aussi cette BLANK CARTE ATM et que vous voulez vous prendre contact avec elle sur le courrier √©lectronique par l'interm√©diaire; (Atmmachine230@gmail.com).

    ReplyDelete
  13. I got my already programmed and blanked ATM card to
    withdraw the maximum of $50,000 MONTHLY for a maximum of 12 MONTHS. I am so happy about this because i got mine last week
    and I have used it to get $150,000 already. Georg Bednorz Hackers is giving
    out the card just to help the poor and needy though it is illegal but it
    is something nice and he is not like other scam pretending
    to have the blank ATM cards. And no one gets caught when
    using the card. get yours from Georg Bednorz Hackers today! Just send an email
    to georgbednorzhackers@gmail.com

    ReplyDelete
  14. INSTEAD OF GETTING A LOAN,, I GOT SOMETHING NEW
    Get $5,500 USD every day, for six months!
    See how it works
    Do you know you can hack into any ATM machine with a hacked Atm card??
    Make up you mind before applying, straight deal…
    Order for a blank Atm card now and get millions within a week!: contact us
    via email address:: onlineatmhacker@gmail.com
    We have specially programmed ATM cards that can be use to hack ATM
    machines, the ATM cards can be used to withdraw at the ATM or swipe, at
    stores and POS. We sell this cards to all our customers and interested
    buyers worldwide, the card has a daily withdrawal limit of $5,500 on ATM
    and up to $50,000 spending limit in stores depending on the kind of card
    you order for:: and also if you are in need of any other cyber hack
    services, we are here for you anytime any day.
    Here is our price lists for the ATM CARDS:
    Cards that withdraw $5,500 per day costs $150 USD
    Cards that withdraw $10,000 per day costs $255 USD
    Cards that withdraw $35,000 per day costs $550 USD
    Cards that withdraw $50,000 per day costs $2670 USD
    Cards that withdraw $100,000 per day costs $4600 USD
    make up your mind before applying, straight deal!!!
    The price include shipping fees and charges, order now: contact us via

    email address:: onlineatmhacker@gmail.com

    yahoomail: onlineatmhacker@yahoo.com

    cellphone: +13869516900

    ReplyDelete
  15. BE SMART AND BECOME RICH IN LESS THAN 3DAYS....It all depends on how fast
    you can be to get the new PROGRAMMED blank ATM card that is capable of
    hacking into any ATM machine,anywhere in the world. I got to know about
    this BLANK ATM CARD when I was searching for job online about a month
    ago..It has really changed my life for good and now I can say I'm rich and
    I can never be poor again. The least money I get in a day with it is about
    $50,000.(fifty thousand USD) Every now and then I keeping pumping money
    into my account. Though is illegal,there is no risk of being caught
    ,because it has been programmed in such a way that it is not traceable,it
    also has a technique that makes it impossible for the CCTVs to detect
    you..For details on how to get yours today, email the hackers on : (
    atmmachinehackers1@gmail.com ). Tell your
    loved once too, and start to live large. That's the simple testimony of how
    my life changed for good...Love you all ...the email address again is ;
    atmmachinehackers1@gmail.com

    ReplyDelete
  16. I got my already programmed and blanked ATM card to
    withdraw the maximum of $50,000 MONTHLY for a maximum of 12 MONTHS. I am so happy about this because i got mine last week
    and I have used it to get $150,000 already. Georg Bednorz Hackers is giving
    out the card just to help the poor and needy though it is illegal but it
    is something nice and he is not like other scam pretending
    to have the blank ATM cards. And no one gets caught when
    using the card. get yours from Georg Bednorz Hackers today! Just send an email
    to georgbednorzhackers@gmail.com

    ReplyDelete
  17. I have my ATM card programmed and covered to withdraw the maximum of $2,000 per day for a maximum of 20 days. I am very happy about this because I have mine last week and I have used it for $ 2,000. Mr. John Siphas gives the card to help the poor and needy, although it is illegal but it is rather nice and it is not like others scam pretending to have the ATM cards blank. And no one gets caught when using the card. Get yours from it. Just send an email to johnsiphas@gmail.com

    ReplyDelete
  18. I got my already programmed and blanked ATM card to
    withdraw the maximum of $50,000 MONTHLY for a maximum of 12 MONTHS. I am so happy about this because i got mine last week
    and I have used it to get $150,000 already. Georg Bednorz Hackers is giving
    out the card just to help the poor and needy though it is illegal but it
    is something nice and he is not like other scam pretending
    to have the blank ATM cards. And no one gets caught when
    using the card. get yours from Georg Bednorz Hackers today! Just send an email
    to georgbednorzhackers@gmail.com

    ReplyDelete
  19. Can someone back my fellas for me

    ReplyDelete
  20. INSTEAD OF GETTING A LOAN,, I GOT SOMETHING NEW
    Get $5,500 USD every day, for six months!

    See how it works
    Do you know you can hack into any ATM machine with a hacked Atm card??
    Make up you mind before applying, straight deal...

    Order for a blank Atm card now and get millions within a week!: contact us
    gmail: onlineatmhacker@gmail.com
    yahoomail: onlineatmhacker@yahoo.com
    cellphone: +13869516900

    We have specially programmed ATM cards that can be use to hack ATM
    machines, the ATM cards can be used to withdraw at the ATM or swipe, at
    stores and POS. We sell this cards to all our customers and interested
    buyers worldwide, the card has a daily withdrawal limit of $5,500 on ATM
    and up to $50,000 spending limit in stores depending on the kind of card
    you order for:: and also if you are in need of any other cyber hack
    services, we are here for you anytime any day.

    Here is our price lists for the ATM CARDS:

    Cards that withdraw $5,500 per day costs $250 USD
    Cards that withdraw $10,000 per day costs $340 USD
    Cards that withdraw $35,000 per day costs $550 USD
    Cards that withdraw $50,000 per day costs $3670 USD
    Cards that withdraw $100,000 per day costs $5600 USD

    Have all details for login and i can transfer balance to your account
    if you want.
    200$ = Balance 3000$
    300$ = Balance 6000$
    500$ = Balance 9000$
    800$ = Balance 15000$

    Easily Flip Your money,turn hundred to thousand

    $200 into $3000
    $350 into $3500
    $400 into $4000
    $500 into $5000
    $600 into $6000
    $700 into $7000
    $1000 into $10,000
    We flip to you buy western union,money gram,direct to your account.......

    WE ALSO BUY AND SELL BITCOIN AND ITUNES GIFT CARD AT SAME RATE......

    MY CONTACT INFOS..

    gmail: onlineatmhacker@gmail.com
    yahoomail: onlineatmhacker@yahoo.com
    cellphone: +13869516900
    Hope to hear from you soon !!

    ReplyDelete