Account Takeover
Introduction
Account Takeover (known as ATO) is a type of identity theft where a bad actor gains unauthorized access to an account belonging to someone else.
How to exploit
Using OAuth Misconfiguration
Victim has a account in evil.com
Attacker creates an account on evil.com using OAuth. For example the attacker have a facebook with a registered victim email
Attacker changed his/her email to victim email.
When the victim try to create an account on evil.com, it says the email already exists.
Try re-sign up using same email
After sign up using victim email, try signup again but using different password
via CSRF
Create an account as an attacker and fill all the form, check your info in the Account Detail.
Change the email and capture the request, then created a CSRF Exploit.
The CSRF Exploit looks like as given below. I have replaced the email value to anyemail@*******.com and submitted a request in the victim’s account.
Chaining with IDOR, for example
500 is an attacker ID and 501 is a victim ID, so we change the userid from attacker to victim ID
No Rate Limit on 2FA
References:
Last updated