Free Link

Introduction

Hello Hackers, ANONDGR is here back again with a new and interesting write-up. In this blog, I will let you in on one of my recent findings. On Bugcrowd, I discovered a critical P1 vulnerability called Account Takeover (ATO). But there is a twist to it, so stick to the end. So, let’s start.

You might be thinking, after seeing the screenshot, that if it is a P1, then how can it be informational? Yet, that is the twist. I will explain it later, but now let’s focus on the vulnerability itself.

Initial Observation/Understanding The Application

So I was hunting on a private program that didn’t have much scope—just 5–6 subdomains, and that’s it. Without spending much time on choosing a target, I picked up a random one, which was just a login page.

But the login function was not usual like others we see on the internet; it was a bit unique.