+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Interesting Concept: Server Consumption/Congestion Attacks (/showthread.php?tid=5393724)
Interesting Concept: Server Consumption/Congestion Attacks - ๖ۣۜCriminal - Sep 2, 2016
http://thehackernews.com/2016/08/hack-facebook-account.html
If you seen from facebook this is quite an interesting vector and I haven't seen it done before till now, I wonder if it's theoretically possible to consume all possible values for other services thus allowing you to reset 1 random account every time you consume every possible range the values would need to not change though and stay static everytime.
* - Gee4rce - Sep 7, 2016
"...and rewarded him $500 "
Jesus Christ what a joke, 500$ for this... that's why i stopped WhiteHatting.
Still though, the method he used has worked and he gained a PoC access, i believe google had the same issue a few months back if i remember correctly.
Cheers, Gee.
* - ๖ۣۜCriminal - Sep 7, 2016
(Sep 7, 2016 02:38 PM)Gee4rce Wrote: "...and rewarded him $500 "
Jesus Christ what a joke, 500$ for this... that's why i stopped WhiteHatting.
Still though, the method he used has worked and he gained a PoC access, i believe google had the same issue a few months back if i remember correctly.
Cheers, Gee.
Yeah im wondering if this can be applied on other things, iv'e been messing around not just in reset functionality like this vuln shows but I wonder if congesting the server values can be done in other places in the web app for interesting stuff to occur aside from the pass reset flows.
* - Gee4rce - Sep 11, 2016
Definately an interesting thought, though i think this vulnerability is not quite 'stealth' and may quickly raise attention.
But from technical point of view this is a nice vuln and i agree there may potentially be room for more about that!
Thanks for the share btw. 🤝
Cheers, Gee.