Summary Attacker can login into any account by entering their phone number and confirmation OTP 1234. The target was not in production, 1234 must be hardcoded or used as a default OTP. Reproduction Steps 1. Go to foo.bar.target.com and click on Login. 2. Enter your phone number.
Summary: When doing recon on Yahoo assets during Hackerone AWC 2023, I found a host foo.bar.yahoo.com. I thought it must be some internal tool for engineers, few pages are listed but clicking on any of the pages redirects to Okta SSO. I found a bug during black
Summary This bug allowed me to access a Management Information System Portal by bruteforcing common passwords. The admin panel allows changing theatre names, theatre status, changing ticket prices, user management, viewing system logs, etc. in South Asian countries. Reproduction Steps 1. Find all the ASNs owned by The Walt Disney
Hey Hackers!! I am Inderjeet aka encodedguy, today I will explain how to bypass the authentication barriers or verification checks for sensitive features. Sensitive Features Many applications have this button that says "Delete your data", "Download your data", "Pay Now", etc. The sensitive feature