[๖ۣۜCriminal]

http://thehackernews.com/2016/08/hack-fa...count.html

If you seen from facebook this is quite an interesting vector and I haven't seen it done before till now, I wonder if it's theoretically possible to consume all possible values for other services thus allowing you to reset 1 random account every time you consume every possible range the values would need to not change though and stay static everytime.

[Gee4rce]

"...and rewarded him $500 "

Jesus Christ what a joke, 500$ for this... that's why i stopped WhiteHatting.
Still though, the method he used has worked and he gained a PoC access, i believe google had the same issue a few months back if i remember correctly.

Cheers, Gee.

[๖ۣۜCriminal]

"...and rewarded him $500 "

Jesus Christ what a joke, 500$ for this... that's why i stopped WhiteHatting.
Still though, the method he used has worked and he gained a PoC access, i believe google had the same issue a few months back if i remember correctly.

Cheers, Gee.

Yeah im wondering if this can be applied on other things, iv'e been messing around not just in reset functionality like this vuln shows but I wonder if congesting the server values can be done in other places in the web app for interesting stuff to occur aside from the pass reset flows.

[Gee4rce]

Definately an interesting thought, though i think this vulnerability is not quite 'stealth' and may quickly raise attention.
But from technical point of view this is a nice vuln and i agree there may potentially be room for more about that!
Thanks for the share btw. 🤝
Cheers, Gee.