Instagram Email Verification Issue

Hey guys! So won't be taking too long, its an year old bug i found in Instagram thought to share, The bug was very simple so not going too write much just simple PoC :).




Steps to reproduce :

1) Create an account on instagram with email "abc@x.com"

2) Login to account and change Email to "def@x.com"

3) Click on the Verification link sent to "def@x.com" this will change email of account to the old email which is "abc@x.com"

Which seems an coding misconfiguration what should happen that after click the confirm link email should change to "def@x.com"


Attack Scenario : 

1) Attacker compromised user Email account "abc@x.com"

2) User came to know about email account compromise.

3) User change his/her instagram email to his /her new email def@x.con

4) User click on the link received at "def@x.com"
but this changes email back to "abc@x.com" ( User dont know about this cause no notification at verify page )

5) User think he/she changed the email and he/she is safe now

5) Attacker request for reset password link of instagram account cause he compromised the old account already and compromise the instagram account.

Video PoC https://drive.google.com/file/d/0Bx2_guht6dHMeVN1UEtOSEY0N2M/view

P.S : Please ignore the video, i used to hunt on father's pc those days :p 

Timeline :
22 Feb 2016 - Initial Report sent to Facebook.
03 March 2016 - Facebook Confirmed and Fixed the issue.
22 March 2016 - 2000$ Rewarded .

:) Started Facebook Bug Bounty again, hope i found something :) 

12 comments:

  1. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (hydracards63@gmail.com) for how to get it and it cost,and how to also hack credit cards and send the money to your self,we are located around the world, these cards works on any ATM machine and it works according to it's activation.

    ………. EXPLANATION OF HOW THESE CARD WORKS……….

    You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT #1,000, 2nd VAULT #5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done.

    ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. To get the card email (hydracards63@gmail.com)

    ReplyDelete
  2. I DONT KNOW WHAT YOU HAVE BEEN THROUGH OR HOW LONG YOU HAVE BEEN LOOKING BUT THIS IS THE LAST STOP AS THERE IS A HACKER WHO CAN HELP YOU WITH SPY WARE ON YOUR CHEATING PARTNER OR UPGRADE YOUR SCHOOL SCORES OR HELP WITH RESULT AND CLEAR ANY CRIMINAL RECORD..

    HACKING OF FACEBOOK , EMAIL , AND BANK ACCOUNTS ARE HIS SPECIALTY.. EMAIL : GREENFR1007@GMAIL.COM OR SKYPE:SATISH.ANCHAN4

    BEST EVER

    ReplyDelete


  3. تقوم افضل شركة شركة نقل عفش من الرياض الى الكويت الاعتماد على توفير عدد من الخدمات الاساسية التى تساعد فى اعمال النقل من اهم ما تقوم شركة
    نقل عفش من الرياض للكويت بتوفيره الاتى
    - الاهتمام بتوفير العماله الاساسية المدربة
    - الاعتماد على افضل السيارات الخاصه باعمال النقل
    - اسعار مميزة وارخص من اسعار النقل التقليدية
    شركة نقل عفش من الرياض الى القصيم

    افضل شركة ديكور بالرياض



    ReplyDelete
  4. Like a resume, an introductory letter can give features of your vocation achievements, a concise synopsis of your profession way, and your applicable aptitudes required for the position. newsletter design

    ReplyDelete


  5. We are the best and leading Content marketing company in India. Facilius Inc is providing the best content marketing services in across the globe.

    ReplyDelete
  6. Dubbing is one of the most important aspects of success of a film. Will you ever see a movie where the dialogues cannot be heard clearly or there.. Email Verification

    ReplyDelete
  7. ★COMPOSITE HACKS★

    🔍🔍Are you Seeking for the Best Legit Professional Hackers online??❓💻💻💻
    Congratulations Your search ends right here with us. 🔍🔍🔍🔍

    🏅COMPOSITE HACKS is a vibrant squad of dedicated online hackers maintaining the highest standards and unparalleled professionalism in every aspect.
    We Are One Of The Leading Hack Teams in The United States🇺🇸🇺🇸 With So many Accolades From The IT Companies🏆🏅🥇. In this online world there is no Electronic Device we cannot hack. Having years of experience in serving Clients with Professional Hacking services, we have mastered them all. You might get scammed for wrong hacking services or by fake hackers on the Internet. Don't get fooled by scamers that are advertising false professional hacking services via False Testimonies, and sort of Fake Write Ups.❌❌❌❌

    * COMPOSITE HACKS is the Answers to your prayers. We Can help you to recover the password of your email, Facebook or any other accounts, Facebook Hack, Phone Hack (Which enables you to monitor your kids/wife/husband/boyfriend/girlfriend, by gaining access to everything they are doing on their phone without their notice), You Wanna Hack A Website or Database? You wanna Clear your Criminal Records?? Our Team accepts all types of hacking orders and delivers assured results to alleviate your agonies and anxieties. Our main areas of expertise include but is never confined to:

    ✅Website hacking 💻,✅Facebook and social media hacking📲, ✅Database hacking, Email hacking⌨️, ✅Phone and Gadget Hacking📲💻,✅Clearing Of Criminal Records❌ ✅Location Tracking✅ Credit Card Loading✅ and many More✅

    🏅We have a trained team of seasoned professionals under various skillsets when it comes to online hacking services. Our company in fact houses a separate group of specialists who are productively focussed and established authorities in different platforms. They hail from a proven track record and have cracked even the toughest of barriers to intrude and capture or recapture all relevant data needed by our Clients. 📲💻

    🏅 COMPOSITE HACKS understands your requirements to hire a professional hacker and can perceive what actually threatens you and risk your business⚔️, relationships or even life👌🏽. We are 100% trusted professional hacking Organization and keep your deal entirely confidential💯. We are aware of the hazards involved. Our team under no circumstances disclose information to any third party❌❌. The core values adhered by our firm is based on trust and faith. Our expert hacking online Organization supports you on time and reply to any query related to the unique services we offer. 💯

    🏅COMPOSITE HACKS is available for customer care 24/7, all day and night. We understand that your request might be urgent, so we have a separate team of allocated hackers who interact with our Clients round the clock⏰. You are with the right people so just get started.💯✅

    ✅CONTACT US TODAY VIA:✅
    📲 compositehacks@gmail.com 📲

    ReplyDelete
  8. Buy instagram Followers Affordable Package
    Buy Instagram Followers, Buy Instagram Likes, Facebook Likes, YouTube Views,
    SoundCloud Plays, Twitter and Vine Followers. Super fast delivery! starting at $0.99 only!.

    ReplyDelete
  9. Our followers can aid your profile become additional credible and trustworthy which has the ability to build it much easier for you to reach new followers. instaexpansion.com offers some in-depth insights on Insta Expansion - Instagram Growth Made Easy.

    ReplyDelete
  10. I utilize an email validation tool: Email Validation
    And the registration is free and also the first 100 emails. It has a very good API and also 98% accuracy.
    I am very happy with it!

    ReplyDelete

Powered by Blogger.