by harshjaiswal · Released March 27, 2016 · Upgraded April 12, 2016
Badoo Accounts Takeover – Bug Bounty POC
Keep in mind that the article is created by Harsh Jaiswalas & any error written down would be entertained best from your We let you to write information on all of our weblog as a guest/contributor so other may learn.If you’re contemplating discussing your receiving through Bug Bounty POC Platform simply sign up on weblog and you may upload freely.
Cheers Bharat & Behroz with this awesome system I’m beginner, soon i ll express my some other 2 FB dilemmas complete really worth 3000$
Hey everyone on the market ! Today i want to show my researching of Badoo that i can takeover individuals profile by just offering him/her a poisionous hyperlink
Badoo is actually a dating-focused social networking provider, started in 2006[4]and headquarters in Soho, London. The website functions in 180 countries and is also preferred in Latin The usa, Spain, Italy and France. Badoo ranks once the 281st best site in the arena, based on Alexa websites since April 2014. This site operates on a freemiummodel. To gain additional features, a person pays a fee or enable Badoo to email all his/her pals.
Lets beginning
Firstly we wanna give thanks to my pal Rudra whom always motivate myself the guy considering myself a simple back link and I also got out an account takeover from it
The bug really was very simple, it works on a CSRF & A token missconfiguration. And just legitimate for
Once we transfer pictures from fb or Instagram it have no any anti-CSRF token, the myspace token which produced via Badoo are appropriate for everyuser. Today i’m able to bring a web link to a person of my personal fb accounts to import images, if user will push fine next photo might be imported to their accounts.
But exactly how i got an takeover here ?
The fact i pointed out that the hyperlink produced can be change the user FB linked account with attacker’s FB profile while the best part ended up being user should just head to connect no cancel or fine pressing called for.
Now an assailant can login via FB and completely takeover the account and will access all his cam, private pictures and everything
The insect is patched within 2 times of intial document. Advantage ($850) got rather less from my expectation .
Tips to reproduce ended up being :-
1 -Create two Badoo profile assailant & sufferer and link 2 diff fb profile in all of them
2- Login as ‘attacker’ and head to transfer images via fb and duplicate the link from Address pub
3- today login as ‘victim’ in diffrent web browser and opened the hyperlink and then click terminate.
4- FB levels of ‘victim’ is actually substituted for FB accounts of ‘attacker’ (taken out of ‘attacker’ one)
5-Login via attacker’s FB membership and you will be signed in as ‘victim’ accounts
Congo u just hacked prey accounts
Additional explanation
Guess a user posses a merchant account of 
assailant ‘A’ with FB linked which ‘FB-of-A’ and a prey levels ‘B’ with fb linked basically ‘FB-of-B’ now attacker write a hyperlink to import photos from their fb and present they to sufferer ‘B’ he opens up it and push terminate but this posses changed their FB account ‘FB-of-B’ to attacker’s FB membership ‘FB-of-A’, nowadays assailant can login together with fb membership in victim’s badoo account.
I am able to talk to my personal sufferer on Badoo and can have hacked his/her accounts in five minutes
Bug Schedule
09 March : Reported 10 March : Bounty treated 850 USD 11 March : insect patched