+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Zoho mail account takeover 0day (/showthread.php?tid=6238009)
Zoho mail account takeover 0day - albozkar - Apr 3, 2023
uploaded the vid on youtube lol https://youtu.be/Sm_tymMHkxI
hope i won't get banned
feel free to use this to hack accounts (can't hack mfs with 2fa)
RE: Zoho mail account takeover 0day - ItachiUchiha - Apr 3, 2023
(Apr 3, 2023 12:46 AM)albozkar Wrote: uploaded the vid on youtube lol https://youtu.be/Sm_tymMHkxI
hope i won't get banned
feel free to use this to hack accounts (can't hack mfs with 2fa)
Offscreen: Reset a password reset, and capture the valid response.
Onscreen: Show that you just requested the password reset. Slap that valid response that was captured in the first step and voila, you're a hax0r.
That password reset link is bound to accounts.
RE: Zoho mail account takeover 0day - albozkar - Apr 3, 2023
(Apr 3, 2023 02:21 AM)Yani Wrote: Holy shit this is fake.
This is literally a glorified inspect element.
You change the failed response to a response you already had in your little textdocument.
why don't you try it yourself first.
RE: Zoho mail account takeover 0day - PurpleMoss - Apr 4, 2023
Not completely implausible but something that would need looking into more. Response manipulation is an attack that's out there. The code that is emailed to the user is checked against the server and if valid, allows the next step, in this case the check comes back as invalid yet feeding the browser with a valid response could just skip that all together and display the next step.