Account Takeover

Authorization Issue

Try to change the email of an account and check how the confirmation works. If weak, try to change the email to the victim one and confirm it.

Unicode Normalization Issue

  1. 1.
    victim account [email protected]
  2. 2.
    create an account using Unicode example: vić[email protected]

Reusing Reset Token

If target allows you to reuse the reset link then hunt for more reset link via gau ,wayback or

Pre Account Takeover

  1. 1.
    Signup using the victims email in the platform and set a password (try to confirm if possible, but lacking access to the victim emails might be impossible)
  2. 2.
    Wait till the victim signs up using oauth and confirms the account
  3. 3.
    Hopefully, the regular signup will be confirmed and you will be able to enter in the victims account

CORS Misconfiguration to Account Takeover

If the page contains CORS missconfigurations you might be able to steal sensitive information from the user to takeover his account or make him change auth information for the same purpose:

Csrf to Account Takeover

If the page is vulnerable to CSRF you might be able to make the user modify his password, email or authentication so you can then access it:

XSS to Account Takeover

If you find a XSS in application you might be able to stal cookies, local storage, or info from the web page that could allow you takeover the account:

Same Origin + Cookies

If you find a limited XSS or a subdomain take over, you could play with the cookies (fixating them for example) to try to compromise the victim account:

Attacking Password Reset Mechanism

Response Manipulation

If the authentication response could be reduced to a simple boolean just try to change false to true and see if you get any access.

OAuth to Account takeover