Account Takeover

🎙️ HackTricks LIVE Twitch Wednesdays 5.30pm (UTC) 🎙️ - 🎥 Youtube 🎥

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access to the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!
Discover The PEASS Family, our collection of exclusive NFTs
Get the official PEASS & HackTricks swag
Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.
Share your hacking tricks by submitting PRs to the hacktricks repo and hacktricks-cloud repo.

Authorization Issue

Try to change the email of an account and check how the confirmation works. If weak, try to change the email to the victim one and confirm it.

Unicode Normalization Issue

victim account victim@gmail.com
create an account using Unicode
example: vićtim@gmail.com

{% content-ref url="unicode-injection/unicode-normalization.md" %} unicode-normalization.md {% endcontent-ref %}

Reusing Reset Token

If target allows you to reuse the reset link then hunt for more reset link via gau ,wayback or scan.io

Pre Account Takeover

Signup using the victims email in the platform and set a password (try to confirm if possible, but lacking access to the victim emails might be impossible)
Wait till the victim signs up using oauth and confirms the account
Hopefully, the regular signup will be confirmed and you will be able to enter in the victims account

CORS Misconfiguration to Account Takeover

If the page contains CORS missconfigurations you might be able to steal sensitive information from the user to takeover his account or make him change auth information for the same purpose:

{% content-ref url="cors-bypass.md" %} cors-bypass.md {% endcontent-ref %}

Csrf to Account Takeover

If the page is vulnerable to CSRF you might be able to make the user modify his password, email or authentication so you can then access it:

{% content-ref url="csrf-cross-site-request-forgery.md" %} csrf-cross-site-request-forgery.md {% endcontent-ref %}

XSS to Account Takeover

If you find a XSS in application you might be able to stal cookies, local storage, or info from the web page that could allow you takeover the account:

{% content-ref url="xss-cross-site-scripting/" %} xss-cross-site-scripting {% endcontent-ref %}

Same Origin + Cookies

If you find a limited XSS or a subdomain take over, you could play with the cookies (fixating them for example) to try to compromise the victim account:

{% content-ref url="hacking-with-cookies/" %} hacking-with-cookies {% endcontent-ref %}

Attacking Password Reset Mechanism

{% content-ref url="reset-password.md" %} reset-password.md {% endcontent-ref %}

Response Manipulation

If the authentication response could be reduced to a simple boolean just try to change false to true and see if you get any access.

OAuth to Account takeover

{% content-ref url="oauth-to-account-takeover.md" %} oauth-to-account-takeover.md {% endcontent-ref %}

References

https://infosecwriteups.com/firing-8-account-takeover-methods-77e892099050