[pepon]

FUCK INTERNET INFORMATION

Yesterday, we reported a serious 0-day vulnerability in Hotmail, allowing users to change the password legitimate mail without any Logeo, password or secret answer questions, only needed the famous Tamper Data add-on and change parameters in the HTTP requests in real time. This allowed many "hackers" (legitimate users) resetearan many accounts passwords of legitimate users. Once the password was "restored", you could access the account simply to leave the new password and no access to the real user account.

As if not enough, today reported another unknown hacker other similar vulnerabilities in Hotmail, Yahoo and AOL. Also made ​​use of Tamper Data to change parameters in HTTP requests and reset the password successfully.

This is one of the most critical vulnerability that affected these 3 companies (Hotmail, AOL and Yahoo) and in passing leaves millions of users affected.

A Microsoft spokesman confirmed the existence of the security flaw and also the score, but gave no details, just said their users "are protected."

Tamper Data

Demonstrations of the three 0-Day:

HOTMAIL:





1. Go to https://maccount.live.com/ac/resetpwdmain.aspx
2. Enter the email you want to change password and the CAPTCHA.
3. Start Tamper Data
4. Remove parameter "SendEmail_ContinueCmd"
5. Change parameter "__V_previousForm" a "ResetOptionForm"
6. Change parameter "__viewstate" to "%% 2BEPFW% 2FwEXAQUDX19QDwUPTmV3UGFzc3dvcmRGb3JtZMw 2Fak6gMIVsxSlDMZxkMkI"
7. Click OK and enter the new password.
8. Start TamperDaTa and add the parameter "__V_SecretAnswerProof" here adds a variable that is not specified: (

YAHOO:





1.Go to https://edit.yahoo.com/forgot
2. Enter the destination email and CAPTCHA.
3.Start Tamper Data.
4. Change parameter "Stage" to "fe200".
5.Click OK and type the new password.
6. Start Tamper Data on the parameter z.
7. Done

AOL:

1. Go to Reset Password page.
2. Enter the destination email and CAPTCHA.
3. Start Tamper Data.
4. Change parameter "action" to "pwdReset".
5. Change parameter "isSiteStateEncoded" to "false".
6. Click OK and enter the new password.
7. Start Tamper Data In rndNO parameter.
8. Done.

🤝

[Hate Sleeping Alone]

i don't know why but captca thing is not working for me / and never worked before on https://maccount.live.com/ac/resetpwdmain.aspx

[YovielMarrero]

This isn't working for me either and Hate Sleeping Alone for hotmail I can't get past that point -_-

[Hate Sleeping Alone]

This isn't working for me either and Hate Sleeping Alone for hotmail I can't get past that point -_-

I knew this exploit beforee, it was posted on other forum but i was never able to fucking bypass that captca thing.
it works fine on "hotmail" but no in maccount.live.com
..

[ironlucario]

Yea like ive been using tamper data for 2 years on multiple online games. i facepalmed when i noticed people were doing it on hotmail.
But is there any currently working hotmail one?

[Gnx]

this is old and patched allready :F over 1 month old it was private earlier -.-

['Cody]

This was probably one of the private exploits, both seem to be fixed now though. Sucks.

[entr0py]

I get to the page to type in a new PW on yahoo, but I don't understand the "Parameter z" instruction? Can anybody give some insight?

[pepon]

still can change some parameters, but has been reported.

[Hate Sleeping Alone]

yahoo didn't work for me
"The password you entered is to be secure.

Your password should be 6 to 32 characters long, can't contain your name or Yahoo! ID, and capitalization matters.
"

even it says '"strong" when i enter ><.

[masc]

There's actually already a new zero day exploit involving tamper data.
Just the method and form is different.

[!!!!]

Code

6. Change parameter "__viewstate" to "%% 2BEPFW% 2FwEXAQUDX19QDwUPTmV3UGFzc3dvcmRGb3JtZMw 2Fak6gMIVsxSlDMZxkMkI"

This appears to be different from what is there on the video!! Is this right?
And its not working!

[Greyersting]

How did anyone ever discover the Hotmail one?

[viM.]

ah sad its patched :(( badluck .. nvm better luck nxt time !!

[Rishidave]

On yahoo error message like this :

"We are experiencing some difficulties processing your request. This is most probably a temporary technical issue, so please try again shortly. If you receive this error again, please contact contact Customer Care for assistance. "....

I think they've patched it