How to Hack PayPal Account
Mr. Yasser tells that How the security breach in paypal and hackers can hijack account just single click. He mentioned in his blog.
In the POC Video Mr. Yasser successfully bypassed the PayPal security to generate exploit code for targeted attacks.
The CSRF token “that authenticate every
single request made by the user” which can be also found in the request
body of every request with the parameter name “Auth” get changed with
every request made by user for security measures, but after a deep
investigation I found out that the CSRF Auth is Reusable for that
specific user email address or username, this means If an attacker found
any of these CSRF Tokens, He can then make actions in the behave of any
logged in user.
Hmm, it seems interesting but still not
exploitable, as there is no way for an attacker to get the “Auth” value
from a victim session.
The CSRF Auth verifies every single
request of that user, So what If an attacker “not logged in” tries to
make a “send money” request then PayPal will ask the attacker to provide
his email and password, The attacker will provide the “Victim Email”
and ANY password, Then he will capture the request, The request will
contain a Valid CSRF Auth token Which is Reusable and Can authorise this
specific user requests. Upon Further Investigation, We have found out
that an Attacker can obtain the CSRF Auth which can be valid for ALL
users, by intercepting the POST request from a page that provide an Auth
Token before the Logging-in process, check this page for the magical
CSRF Auth “https://www.paypal.com/eg/cgi-bin/webscr?cmd=_send-money”. At
this point the attacker Can CSRF “almost” any request on behave of this
user.
The application generates a valid “Auth” token for a logged-out user!
Through examination of the password
change process, he found that an attacker can’t Change the victim
password without answering the Security Questions set by user, Also the
user himself can’t change the security questions without entering the
password!
The initial process of “setting” security questions is not password protected and is reusable.
After further investigation, noticed
that the request of setting up the security questions “which is
initiated by the user while signing up” is not password-protected, and
it can be reused to reset the security questions up without providing
the password, hence, Armed with the CSRF Auth, an attacker can CSRF this
process too and change the victim’s Security questions.
At this point, An attacker can conduct a targeted CSRF attack against a PayPal users and take a full control over his account.
Hence, An attacker can CSRF all the requests including but not limited to:1- Add/Remove/Confirm Email address
2-Add fully privileged users to business account
3- Change Security questions
4- Change Billing/Shipping Address
5- Change Payment methods
6- Change user settings(Notifications/Mobile settings) ………… and more.
To automate the who process, Yasser has
coded a Python interactive server to demonstrate how an attacker can
exploit this vulnerability in a real-life scenario attack.
-> Now this Vulnerability has been patched. HOC congrates to Mr. Yasser to get $10,000 reward for this vulnerability.
SUBSCRIBE US ON YOUTUBE :- https://www.youtube.com/channel/UC3SdJHbnRGaeatRYFfFLMvw LIKE US ON FACEBOOK :- http://viid.me/qtGbUW
Comments
Post a Comment