Veris.in Account Takeover

Hey Guys! Today I'll share you my Account takeover finding on Veris.in, So no more waste of time and start.



I installed Android app of Veris and started testing it, In Veris app we need to first verify our number and then we can register, While doing this i captured my request and try to bruteforce the OTP and noticed that there was no rate limitation so now i can use anyone's number in my account. So i did reported it, Now that was not a big deal, Then i started testing further after so many things my mind just noticed that every request have this type of structure,

POST /api/v1/*Any Functionality*/ HTTP/1.1
Authorization: token b910cxxx2ac02f3a8xxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1; )
Host: live.veris.in
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 26

The thing i noticed that there is not like user session thing, it was working on a token ( In Authorization Header) Which is an authorization to API of veris but my mind said "from where did it came from :O like i have not entered any password" And then i said "Oh lol i entered One Time Password", 

So what happening here is when we enter number it sends a OTP to it and then after OTP verification it generates a token to authenticate us with API and check is the number match with any account in database, if does exist we'll be logged in that account. Now as i mentioned earlier "No Rate Limit on OTP" Now i can use this to generate OTP for your number and get a token for it by bruteforcing and Bhoom I can use the token to modify info of your account.

POST /api/v1/change_email/ HTTP/1.1
Authorization: token **BRUTEFORCED TOKEN GOES HERE**
Content-Type: application/json
User-Agent: Dalvik/2.1.0 (Linux; U; Android 5.1; )
Host: live.veris.in
Connection: Keep-Alive
Accept-Encoding: gzip
Content-Length: 26

{"email":"hacker@hack.com"}

If the number is NOT registered it will give a response like this one (Token Generated)

If the number is registered it will give a response like this one (Token Generated)

Video Proof of Concept






9 comments:

  1. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (hydracards63@gmail.com) for how to get it and it cost,and how to also hack credit cards and send the money to your self,we are located around the world, these cards works on any ATM machine and it works according to it's activation.

    ………. EXPLANATION OF HOW THESE CARD WORKS……….

    You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT #1,000, 2nd VAULT #5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done.

    ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. To get the card email (hydracards63@gmail.com)Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (hydracards63@gmail.com) for how to get it and it cost,and how to also hack credit cards and send the money to your self,we are located around the world, these cards works on any ATM machine and it works according to it's activation.

    ………. EXPLANATION OF HOW THESE CARD WORKS……….

    You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT #1,000, 2nd VAULT #5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done.

    ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. To get the card email (hydracards63@gmail.com)

    ReplyDelete
  2. Hello Everybody, My name is Mrs Sharon Sim. I live in Singapore and i am a happy woman today? and i told my self that any lender that rescue my family from our poor situation, i will refer any person that is looking for loan to him, he gave me happiness to me and my family, i was in need of a loan of S$250,000.00 to start my life all over as i am a single mother with 3 kids I met this honest and GOD fearing man loan lender that help me with a loan of S$250,000.00 SG. Dollar, he is a GOD fearing man, if you are in need of loan and you will pay back the loan please contact him tell him that is Mrs Sharon, that refer you to him. contact Dr Purva Pius,via email:{urgentloan22@gmail.com} Thank you.

    ReplyDelete
  3. دليل التجهيزات الشامل اكبر دليل يقوم بتوفير تجهيزات فنادق باسرع ما يمكن حيث اننا نتخصص بتوفير كافه معدات سوبر ماركت بارخص الاسعار ونقوم بتركيبها وصيانتها بشكل متميز
    تابع موقعنا عبر
    http://www.hotel-restaurant-eg.com

    ReplyDelete
  4. سارعوا بالتعاقد مع شركة مكافحة حشرات في مصر وسنصل اليكم في الحال ونقوم بخدمات ابادة حشرات المنزل باحترافيه وطردها من المكان الي الابد كما نقوم بخدمات فحص دوريه للتأكد من نظافه المكان من اى حشرات
    تابع موقعنا عبر
    www.anti-insects.com

    ReplyDelete
  5. الاحترافيه لدي اطباء مركز زراعة الشعر في تركيا لاجراء الابحاث العلمية الحديثة ليتمكنوا من زراعة الشعر في تركيا بطريقة طبيه امنه اعتمادا علي افضل انواع العلاج لمنع تساقط الشعر ومعالجة الصلع
    تابع موقعنا عبر
    www.hairtransplant1.com

    ReplyDelete
  6. يتم استخدام اجهزة رش حديثة تساعد فريق عماله شركة مكافحة حشرات بالخبر في رش المبيدات في الاماكن الضيقه لقتل الحشرات والتخلص منها نهائيا , وتعد ابراج دبي من اكبر الشركات التى تهتم بالاعمال المنزلية فنقوم بتنظيف البيارات باحترافيه ولذلك يفضل الجميع شركة تسليك مجاري بالدمام لخدماتها المميزه واسعارها التى تناسب الجميع
    تابع موقعنا للتفاصيل
    http://abraj-dubai.net/%D8%B4%D8%B1%D9%83%D8%A7%D8%AA-%D9%85%D9%83%D8%A7%D9%81%D8%AD%D8%A9-%D8%A7%D9%84%D9%86%D9%85%D9%84-%D8%A7%D9%84%D8%A7%D8%A8%D9%8A%D8%B6-%D8%A8%D8%A7%D9%84%D8%AF%D9%85%D8%A7%D9%85/

    ReplyDelete
  7. خدمة العملاء في توكيل ال جي تتوافر علي مدار 24 ساعه يوميا وتقوم بالرد علي استفسارات عملائه الكرام في الحال وتقوم بارسال مهندسيين وفنيين صيانة ال جي الي العملاء في المنازل للتمكن من اصلاح وصيانة الاجهزة الكهربائية
    للتفاصيل زوروا موقعنا عبر
    www.lgmaintenance.com

    ReplyDelete

Powered by Blogger.