Mohan Kallepalli's

Unauthorised Accessing of Google Calendar Invites Google Calendar, a common and very well known feature that everyone uses for scheduling and organising meetings within an organisation that uses " Google for Work ". The Bug! Failure to restrict the access to unauthorised personal. Story, While scheduling a meeting with my work team to present a demo, I came across the functionality in Google calendar to add groups as guest. Once a group is added, Calendar will automatically expands the group and adds all members to the meeting. While doing so, it prompts the organiser if (s)he wants to send the meeting invites to the guest list. Once the meeting is scheduled, all the meeting invitations will actually be sent from the user/organiser's mail account. That means, once you schedule a meeting, if you go and check your sent mail box, we can find all the meeting invites that were sent to all the guest. Figure: sent mail box with target mail So far...

Another bug in Facebook. This time on multiple subdomains of FB are found to be vulnerable to brute forcing. Facebook is not limiting the attempts made to access disavowed page, resulting account take over by brute force. Vulnerability Type : Missing rate limiting or anti automation measures Vulnerable Service : Facebook Disavow Vulnerable URL : https://www.facebook.com/hacked/disavow?u=100007881843952&n=JIjLVAuY Vulnerable Domains : All the following domains are found to be vulnerable with the same flaw.   www.facebook.com   www.beta.facebook.com   m.facebook.com   m.beta.facebook.com   iphone.facebook.com   developers.facebook.com   lookaside.facebook.com Attack Scenario : Assume victim has forgot his/her password and used the forgot password feature to reset his/her account password. Now facebook will send a password reset confirmation mail, which contains a link for incase if t...

Instagram application is not validating the number of requests made to login into user account, which made it possible to brute force the password of any Instagram user Account. Issue reported to Facebook through their whitehat program, but unfortunately I am not the first one to do so. So the report was made duplicate and the issue is found to be fixed in few hours. While brute-forcing, the application throughs an error in the response body, but sets an authenticated session cookie. So, once we refresh, the browser uses the newly set cookie and establishes logged in browsing session. The following is a video demonstrating the same ( post brute force action, not the actual brute force).

This summary is not available. Please click here to view the post.

Its been a while since i published my last post. So, here i come with a write up for chaining of multiple issues in Facebook Acquisition - Instagram, that could allowed me to delete entire comments/captions from the Instagram DB . Instagram Web and mobile Applications For the first 2 hours or so, I could not find anything as each request is added with a signature and I am lazy enough not to understand/reverse the signature logic. So as usual, i was about the close my Mac and then, saw a request without signature. request without a signature Bingo..something to play around. so i started working on the request, trying to find most common bugs, like sqli,xss, csrf etc.. Then to cross verify a csrf issue, I used my browser. But to my surprise, in later requests in browser app, there is no signature at all, but of-course csrf issue is properly protected. So while testing with both the App and Browser together, I realised that there is an authorisation ...

Hi friends, I am back with Three stories Today. There are multiple critical bugs effecting the e-front, one of the Top 10 e-learing cms available, version 3.6.15.4 build 18023. The details are as follows. Directory Traversal       ( CVE : 2015-4461 ) Local File Inclusion      ( CVE : 2015-4462 ) Bypass for Blocked extension file uploads      ( CVE : 2015-4463 ) About the e-front:   E-front is one of the Top 10 e-learning cms available free on the market till date. A small description from the vendor's site: "The core of eFront is distributed as an open-source project. We have created a superior training product and we are not afraid to let you try it! The open-source edit of eFront will cover a wide range of your needs. If you are looking for a specialized solution then take a look at different efront editions ." The Issues are fixed as part of new release, efront v3.6.15.5 build 18024. You can find the chan...

How I was able to send a mail with Your Email Id? Is it possible? Yes. It is. If you are using Gmail, until yesterday, I can send email with your email id. Do u want to know how? Read my story then.... Hi Friends, This is Mohan Kallepalli, again with another bug in gmail ... Thanks to facebook, another day started with frustration. I will tell u that story another time. Anyway, with the frustration on facebook, i turned my focus to my favorite Google one more time. While I was going through the Gmail settings, thanks to my low speed internet, my browser suggested me to use "Basic HTML". Once i opened my settings in Basic HTML, i went to Accounts section and there i saw the functionality for adding another users email id to your " send email as " list. This functionality is protected by a verification code authentication mechanism. which means, Gmail will send a verification code (9digits) to the target email id and you need to enter that code in your v...

Hi Guys, Another bug in Google.. This time is with youtube.com Hmm.. Found a bug in Youtube.. but unfortunately, this bug is out of scope.. Anyway, a bug is a bug.. Lets see.. The issue is an URL redirection vulnerability that existing in upload.youtube.com. When you upload a video which is not proper (invalid), the application redirects you to error URL. This URL is being sent to the server as a parameter, error_redirect . I tried changing the url to some random domain, and guess what, it redirected as i have uploaded an invalid video. Then, in the request i observed there are two user specific tokens going to the server. They are nothing but anti-csrf tokens and working properly with a valid video. But in the case of an invalid video, they are no longer validated and are being ignored. So i tried to send the request with invalid file, but this time i removed the user specific tokens user_token and session_token . And as i expected, the application issued an 302 redirection...

Hey Guys, Today I would like to show you, how i was able to create custom XSS payloads based on existing javascripts in various websites. Note that this write-up does not show you how to get XSS in various websites, but it covers various ways to create custom xss payloads. The approach i follow to create a successful xss payload involves in 3 steps. 1. Analyse the native code 2. Construct the correct syntax 3. Execute the payload For explanation purpose i considered GET based user input, however, this method will work on POST method also. 1. Analyse : This stage involves the analysis of the web-page code in which we are creating a payload. It is important that the main limitation in this stage is that, the user input we entering should be returned in between script tags. index.php?name=test  should return the payload as follows. <script> ........... .. test .. ........... </script> If the user input is not rendering in bet...

Hey Guys, This bug i reported a longback and fixed now. Lets jump into the story. In GMAIL settings general tab, there is an option for creating an automatic mail responder, in case if we go on a vacation and if we dont want to be disturbed. While going through gmail, like all the others, i also ignored that feature and tried here and there. At the same time one of my goood friend @iampr3m was also testing Gmail and he was trying hard to find something in the same settings page. However that guy begin his testing from the top and testing in the Signature feature. So i started testing the settings page from bottom and i got lucky to have the vacation responder in the bottom of the page. So, while testing, I observed that the vacation message is going in between a div tag. So as usual, i used a simple payload with img tag (   <img src=a onerror=alert(1)>  ) to test my luck. As soon as the payload entered with < and >, the server invalidat...

Simple Login Page Bypass Using SQLi.. The following code is being used in a login check page. Find the proper credentials for getting a successful authentication alert. $result = mysql_query($sql); if(mysql_num_rows($result) == 0){ echo "<script>alert('failed')</script>"; } else { $res = mysql_fetch_array($result); if($res[2]==$pwd&&((!$res[7])&&($res[3]))) { echo "<script>alert('success');</script>"; } else { echo "<script>alert('failed');</script>"; } } Find USERNAME & PASSWORD or find the answers here username : ' UNION SELECT 'TEST','FOR','SQLI',1,'N','USER','NAME',0 -- - password : SQLI

Hello Guys, Today i would like to share a Cross Site Scripting Vulnerability that was existing in JSON/AJAX callback functionality. I found this vulnerability a few days back, but as the bug is fixed now, i'd like to share the story. The vulnerability is existing in the forgot password functionality. The forgot password functionality uses an ajax based request/response mechanism within the login page. While testing the application, i observed that the application is using a callback function to render the response into the application. This callback function name is being passed as a GET parameter. With a little analysis, i found that the callback parameter is vulnerable to Cross Site Scripting vulnerability. So i extracted the forget password request and crafted a GET based URL request with a simple XSS payload as the callback value. https://www.DUMMY-WEBSITE.com/users/ajaxonforgotpassword.php?callback=<script>alert(document.cookie)</script>...

Cross Site Scripting Filter Bypassing using CRLF..... This is my first technical writing. So please share your reviews and suggestions.. I would like to share a cross site scripting vulnerability found in one of the application I was testing. Usually xss is very common in the websites. However I found this one interesting, as this vulnerability is triggered using another known vulnerability CRLF. The application I was testing is very secured in case of xss as it is having restrictions on both input and output. 1. whenever a tag with "<" and ">" together (like <script>)is used in input, the application will filter and redirect to an error page. 2. If you use either "<" or ">" without the other then it'll encode the input to html entity encoded form. So I find this irritating and tried all known attack vectors, found nothing but logged out forcibly. So I stopped hunting for xss and concentrated mor...