# Account Takeover
{% hint style="success" %}
Learn & practice AWS Hacking:
[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
Learn & practice GCP Hacking: 
[**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}
## **Authorization Issue**
Barua pepe ya akaunti inapaswa kujaribiwa kubadilishwa, na mchakato wa uthibitisho **unapaswa kuchunguzwa**. Ikiwa utagundulika kuwa **dhaifu**, barua pepe inapaswa kubadilishwa kuwa ya mwathirika anayepangwa na kisha kuthibitishwa.
## **Unicode Normalization Issue**
1. Akaunti ya mwathirika anayepangwa `victim@gmail.com`
2. Akaunti inapaswa kuundwa kwa kutumia Unicode\
kwa mfano: `vićtim@gmail.com`
Kama ilivyoelezwa katika [**hili mazungumzo**](https://www.youtube.com/watch?v=CiIyaZ3x49c), shambulio la awali linaweza pia kufanywa kwa kutumia watoa huduma wa utambulisho wa upande wa tatu:
* Unda akaunti katika utambulisho wa upande wa tatu kwa barua pepe inayofanana na ya mwathirika kwa kutumia wahusika fulani wa unicode (`vićtim@company.com`).
* Mtoa huduma wa upande wa tatu hapaswi kuthibitisha barua pepe
* Ikiwa mtoa huduma wa utambulisho anathibitisha barua pepe, labda unaweza kushambulia sehemu ya domain kama: `victim@ćompany.com` na kujiandikisha kwa hiyo domain na kutumaini kwamba mtoa huduma wa utambulisho anaunda toleo la ascii la domain wakati jukwaa la mwathirika linanormalize jina la domain.
* Ingia kupitia mtoa huduma huyu wa utambulisho katika jukwaa la mwathirika ambaye anapaswa kunormalize wahusika wa unicode na kukuruhusu ufikie akaunti ya mwathirika.
Kwa maelezo zaidi, rejelea hati kuhusu Unicode Normalization:
{% content-ref url="unicode-injection/unicode-normalization.md" %}
[unicode-normalization.md](unicode-injection/unicode-normalization.md)
{% endcontent-ref %}
## **Reusing Reset Token**
Ikiwa mfumo wa lengo unaruhusu **kiungo cha kurekebisha kutumika tena**, juhudi zinapaswa kufanywa **kutafuta viungo zaidi vya kurekebisha** kwa kutumia zana kama `gau`, `wayback`, au `scan.io`.
## **Pre Account Takeover**
1. Barua pepe ya mwathirika inapaswa kutumika kujiandikisha kwenye jukwaa, na nenosiri linapaswa kuwekwa (jaribio la kuthibitisha linapaswa kufanywa, ingawa kukosa ufikiaji wa barua pepe za mwathirika kunaweza kufanya hili kuwa gumu).
2. Mtu anapaswa kusubiri hadi mwathirika ajiandikishe kwa kutumia OAuth na kuthibitisha akaunti.
3. Inatarajiwa kwamba usajili wa kawaida utathibitishwa, ukiruhusu ufikiaji wa akaunti ya mwathirika.
## **CORS Misconfiguration to Account Takeover**
Ikiwa ukurasa una **CORS misconfigurations** unaweza kuwa na uwezo wa **kuiba taarifa nyeti** kutoka kwa mtumiaji ili **kuchukua akaunti yake** au kumfanya abadilishe taarifa za uthibitisho kwa kusudi sawa:
{% content-ref url="cors-bypass.md" %}
[cors-bypass.md](cors-bypass.md)
{% endcontent-ref %}
## **Csrf to Account Takeover**
Ikiwa ukurasa unahatarishwa kwa CSRF unaweza kuwa na uwezo wa kumfanya **mtumiaji abadilishe nenosiri lake**, barua pepe au uthibitisho ili uweze kisha kuifikia:
{% content-ref url="csrf-cross-site-request-forgery.md" %}
[csrf-cross-site-request-forgery.md](csrf-cross-site-request-forgery.md)
{% endcontent-ref %}
## **XSS to Account Takeover**
Ikiwa unapata XSS katika programu unaweza kuwa na uwezo wa kuiba vidakuzi, hifadhi ya ndani, au taarifa kutoka kwa ukurasa wa wavuti ambayo inaweza kukuruhusu kuchukua akaunti:
{% content-ref url="xss-cross-site-scripting/" %}
[xss-cross-site-scripting](xss-cross-site-scripting/)
{% endcontent-ref %}
## **Same Origin + Cookies**
Ikiwa unapata XSS iliyopunguzika au kuchukua subdomain, unaweza kucheza na vidakuzi (kuvifunga kwa mfano) kujaribu kuathiri akaunti ya mwathirika:
{% content-ref url="hacking-with-cookies/" %}
[hacking-with-cookies](hacking-with-cookies/)
{% endcontent-ref %}
## **Attacking Password Reset Mechanism**
{% content-ref url="reset-password.md" %}
[reset-password.md](reset-password.md)
{% endcontent-ref %}
## **Response Manipulation**
Ikiwa jibu la uthibitisho linaweza **kupunguzwa kuwa boolean rahisi jaribu kubadilisha false kuwa true** na uone ikiwa unapata ufikiaji wowote.
## OAuth to Account takeover
{% content-ref url="oauth-to-account-takeover.md" %}
[oauth-to-account-takeover.md](oauth-to-account-takeover.md)
{% endcontent-ref %}
## Host Header Injection
1. Header ya Host inabadilishwa kufuatia kuanzishwa kwa ombi la kurekebisha nenosiri.
2. Header ya `X-Forwarded-For` inabadilishwa kuwa `attacker.com`.
3. Headers za Host, Referrer, na Origin zinabadilishwa kwa wakati mmoja kuwa `attacker.com`.
4. Baada ya kuanzisha kurekebisha nenosiri na kisha kuchagua kutuma tena barua, mbinu zote tatu zilizotajwa hapo juu zinatumika.
## Response Manipulation
1. **Code Manipulation**: Kiwango cha hali kinabadilishwa kuwa `200 OK`.
2. **Code and Body Manipulation**:
* Kiwango cha hali kinabadilishwa kuwa `200 OK`.
* Mwili wa jibu unabadilishwa kuwa `{"success":true}` au kitu kisichokuwa na kitu `{}`.
Mbinu hizi za urekebishaji ni bora katika hali ambapo JSON inatumika kwa usafirishaji na kupokea data.
## Change email of current session
Kutoka [ripoti hii](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea):
* Mshambuliaji anahitaji kubadilisha barua yake na mpya
* Mshambuliaji anapata kiungo cha kuthibitisha mabadiliko ya barua pepe
* Mshambuliaji anamtumia mwathirika kiungo ili abofye
* Barua pepe ya mwathirika inabadilishwa kuwa ile iliyotajwa na mshambuliaji
* Mshambuliaji anaweza kurejesha nenosiri na kuchukua akaunti
Hii pia ilitokea katika [**ripoti hii**](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea).
### Old Cookies
Kama ilivyoelezwa [**katika chapisho hili**](https://medium.com/@niraj1mahajan/uncovering-the-hidden-vulnerability-how-i-found-an-authentication-bypass-on-shopifys-exchange-cc2729ea31a9), ilikuwa inawezekana kuingia kwenye akaunti, kuhifadhi vidakuzi kama mtumiaji aliyethibitishwa, kutoka, na kisha kuingia tena.\
Kwa kuingia mpya, ingawa vidakuzi tofauti vinaweza kuundwa, vya zamani vilianza kufanya kazi tena.
## References
* [https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050](https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050)
* [https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea](https://dynnyd20.medium.com/one-click-account-take-over-e500929656ea)
{% hint style="success" %}
Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\
Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte)
Support HackTricks
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
{% endhint %}