Instagram Email Verification Issue

Hey guys! So won't be taking too long, its an year old bug i found in Instagram thought to share, The bug was very simple so not going too write much just simple PoC :).




Steps to reproduce :

1) Create an account on instagram with email "abc@x.com"

2) Login to account and change Email to "def@x.com"

3) Click on the Verification link sent to "def@x.com" this will change email of account to the old email which is "abc@x.com"

Which seems an coding misconfiguration what should happen that after click the confirm link email should change to "def@x.com"


Attack Scenario : 

1) Attacker compromised user Email account "abc@x.com"

2) User came to know about email account compromise.

3) User change his/her instagram email to his /her new email def@x.con

4) User click on the link received at "def@x.com"
but this changes email back to "abc@x.com" ( User dont know about this cause no notification at verify page )

5) User think he/she changed the email and he/she is safe now

5) Attacker request for reset password link of instagram account cause he compromised the old account already and compromise the instagram account.

Video PoC https://drive.google.com/file/d/0Bx2_guht6dHMeVN1UEtOSEY0N2M/view

P.S : Please ignore the video, i used to hunt on father's pc those days :p 

Timeline :
22 Feb 2016 - Initial Report sent to Facebook.
03 March 2016 - Facebook Confirmed and Fixed the issue.
22 March 2016 - 2000$ Rewarded .

:) Started Facebook Bug Bounty again, hope i found something :) 

8 comments:

  1. Hack and take money directly from any ATM Machine Vault with the use of ATM Programmed Card which runs in automatic mode. email (hydracards63@gmail.com) for how to get it and it cost,and how to also hack credit cards and send the money to your self,we are located around the world, these cards works on any ATM machine and it works according to it's activation.

    ………. EXPLANATION OF HOW THESE CARD WORKS……….

    You just slot in these card into any ATM Machine and it will automatically bring up a MENU of 1st VAULT #1,000, 2nd VAULT #5,000, RE-PROGRAMMED, EXIT, CANCEL. Just click on either of the VAULTS, and it will take you to another SUB-MENU of ALL, OTHERS, EXIT, CANCEL. Just click on others and type in the amount you wish to withdraw from the ATM and you have it cashed instantly… Done.

    ***NOTE: DON’T EVER MAKE THE MISTAKE OF CLICKING THE “ALL” OPTION. BECAUSE IT WILL TAKE OUT ALL THE AMOUNT OF THE SELECTED VAULT. To get the card email (hydracards63@gmail.com)

    ReplyDelete
  2. I DONT KNOW WHAT YOU HAVE BEEN THROUGH OR HOW LONG YOU HAVE BEEN LOOKING BUT THIS IS THE LAST STOP AS THERE IS A HACKER WHO CAN HELP YOU WITH SPY WARE ON YOUR CHEATING PARTNER OR UPGRADE YOUR SCHOOL SCORES OR HELP WITH RESULT AND CLEAR ANY CRIMINAL RECORD..

    HACKING OF FACEBOOK , EMAIL , AND BANK ACCOUNTS ARE HIS SPECIALTY.. EMAIL : GREENFR1007@GMAIL.COM OR SKYPE:SATISH.ANCHAN4

    BEST EVER

    ReplyDelete


  3. تقوم افضل شركة شركة نقل عفش من الرياض الى الكويت الاعتماد على توفير عدد من الخدمات الاساسية التى تساعد فى اعمال النقل من اهم ما تقوم شركة
    نقل عفش من الرياض للكويت بتوفيره الاتى
    - الاهتمام بتوفير العماله الاساسية المدربة
    - الاعتماد على افضل السيارات الخاصه باعمال النقل
    - اسعار مميزة وارخص من اسعار النقل التقليدية
    شركة نقل عفش من الرياض الى القصيم

    افضل شركة ديكور بالرياض



    ReplyDelete
  4. Like a resume, an introductory letter can give features of your vocation achievements, a concise synopsis of your profession way, and your applicable aptitudes required for the position. newsletter design

    ReplyDelete


  5. We are the best and leading Content marketing company in India. Facilius Inc is providing the best content marketing services in across the globe.

    ReplyDelete
  6. Dubbing is one of the most important aspects of success of a film. Will you ever see a movie where the dialogues cannot be heard clearly or there.. Email Verification

    ReplyDelete

Powered by Blogger.