IDOR on Ios Application

 A friend asked me to do a pentest for their company,A  Kenyan fintech company.For obvious reasons i cannot name the company. Everything was to be audited(sites,android and ios apps)

After looking at the websites i couldn't find anything interesting except for  enabled xmrplc,broken links hijacking  and some unrestricted directories. I even tried scanning the site with wpscan.WordPress sucks!

As a newbie ios pentester i decided to challenge myself to find atleast one bug on their app.After downloading the app from the appstore i proxied the iphone  to burpsuite.As static analysis of ios app is tiresome and not straightforward as android(just unpacking the apk file which is basically zip file) i opted for dynamic analysis.The procedure of setting up proxy in ios is the same as on android,just set ip address and port then install burp certificate. Fortunately ,No ssl pinning :)


I started by signing up on the app.I received the confirmation  email and my 4 numbers PIN.I then tried bruteforcing the PIN as 4 number PINs are insecure(only 10,000 possible combinations).sadly after 4 failed tries the account gets locked 

after sorting out locked out issue,i logged in and checked burpsuite for profile details traffic and to my shock there was an id parameter.

I just changed my Id by adding one to the last character and when i checked the response tab i saw another customer details(phone number,name,balance).

The screenshot shows the request and response.



So what's the most critical thing i could do, why not try withdrawing as the IDOR bug gave my full access to other users accounts?. I could even change their PIN.

I tried withdrawing but could find withdrawal button so i was left disappointed 

Comments

Post a Comment

Popular posts from this blog

SOME BUGS

Image
 It's been  a while since i wrote anything related to bug bounty or hacking.In that time i have had some interesting and bad experiences with bug bounty programs.from fast responses to scam external  programs I won't be naming/ shaming the programs but soon i will put up a comprehensive list of scam programs to avoid. Let's talk about some of the bugs; 1. Authentication bypass via path normalization i was hunting on some match matching/dating site.after finding subdomains via crt.sh and fuzzing the subdomains with a wordlist.i found a login page;  min.site.com I started to fuzz to files with ffuf with a custom wordlist.with no result i looked for sqli but found non.tried response manipulation.again failed I was about to give up then i click on a png file.deleted the pic.png and got 403 error.using script https://github.com/iamj0ker/bypass-403 on it i  could list images on the server! https://login.site.com/images// I tried https://login.site.com// also https://...
Read more

Not A Guide to hacking betting sites

  DISCLAIMER!!!   This is for educational purposes only and not a guide to hacking betting sites. In this writeup i will try to provide some bugs i have found on betting sites during my almost 3years bug bounty journey.I have reported more than 100 vulnerabilities on betting websites and android application but i will only talk about some bugs.Sorry,I don't have screenshots to demonstrate the vulnerabilities so i will just list  some bugs and their impacts.I will not name the companies for obvious reasons The writeup lists some  vulnerabilities bug hunters can look for while hunting on betting platforms so grab some coffee and popcorn and enjoy! Some are interesting like  changing odds or withdrawing twice or withdrawing money more than your balance:) IDOR I found most of IDOR on betting sites on profile id parameters.some occurred on bet history where i could change user bet id history and get any user betting history on the site. SQLI Most of then were blind s...
Read more

Taking a Delorean car back to the future:Time related attacks

Image
After thinking about what to write about and having some ideas which are still half done and in draft.I decided to write this! As a car enthusiast with love for classic cars and passion for bringing back old cars to life. I would admit and hope my good friend mark whom we disagrees on most ideas are on the same page here.Delorean was a beauty.If you have not watched Back to the Future movies you are missing out. sit at the back left and let me drive you through time.oops! i forgot delorean is a two-passenger sports car ,but why not go to the future,2024 and get the new powerful delorean alpha5.A better looking super-fast,2+2 coupe , electric car. Enough with the car analogy,we as hackers love technical stuff,nevertheless i believe nowadays i am starting to appreciate the non-technical aspects,folks and roles in tech. In this blog i will discuss some attacks that could impact software from a time change.changing time to the future or back to the past could impact the normal working of ...
Read more