In the name of Allah the beneficent the Merciful.
It was a thursday night (day before my semester exam) when i came to
know that whatsapp is now a part of Facebook bug bounty and started
hunting on it.
Soon i discovered an open redirection Flaw in whatsapp translate website translate.whatsapp.com .
Whatsapp translate has more than 10 million of it's users in all over the world.
Open redirection occurs when application doesn't validate the url which victim is visiting . This gives attacker to redirect victim's to malicious sites and perform phishing ,etc kind of attacks.
Here is the POST request
GET /sign-in?next=http://google.com/ HTTP/1.1
Host: translate.whatsapp.com
Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML,
like Gecko) Ubuntu Chromium/49.0.2623.108 Chrome/49.0.2623.108
Safari/537.36
Referer: https://translate.whatsapp.com/
After sign in whatsapp translate would have redirected user to google.com .
Here is the Video Proof of Concept demonstrating attack.
Unfortunately After few days i got response from Facebook Security Team saying it's a duplicate issue.
Thanks for Reading
Jai Hind :)
Contact info :
facebook : facebook.com/haji.mohd871
twitter : @mohdhaji24
linkedin : linkedin.com/in/mohd-haji-490960a0
facebook : facebook.com/haji.mohd871
twitter : @mohdhaji24
linkedin : linkedin.com/in/mohd-haji-490960a0
I learn some new stuff from it too, thanks for sharing your information.
ReplyDeleteTranslation services near me
DeleteHello all
am looking few years that some guys comes into the market
they called themselves hacker, carder or spammer they rip the
peoples with different ways and it’s a badly impact to real hacker
now situation is that peoples doesn’t believe that real hackers and carder scammer exists.
Anyone want to make deal with me any type am available
Available Services
..Wire Bank Transfer all over the world
..Western Union Transfer all over the world
..Credit Cards (USA, UK, AUS, CAN, NZ)
..School Grade upgrade / remove Records
..Spamming Tool
..keyloggers / rats
..Social Media recovery
.. Teaching Hacking / spamming / carding (1/2 hours course)
discount for re-seller
Contact: 24/7
fixitrogers@gmail.com
LEGIT FULLZ & TOOLS STORE
DeleteHello to All !
We are offering all types of tools & Fullz on discounted price.
If you are in search of anything regarding fullz, tools, tutorials, Hack Pack, etc
Feel Free to contact
***CONTACT 24/7***
**Telegram > @leadsupplier
**ICQ > 752822040
**Skype > Peeterhacks
**Wicker me > peeterhacks
"SSN LEADS/FULLZ AVAILABLE"
"TOOLS & TUTORIALS AVAILABLE FOR HACKING, SPAMMING,
CARDING, CASHOUT, CLONING, SCRIPTING ETC"
**************************************
"Fresh Spammed SSN Fullz info included"
>>SSN FULLZ with complete info
>>CC With CVV (vbv & non vbv) Fullz USA
>>FULLZ FOR SBA, PUA & TAX RETURN FILLING
>>USA I.D Photos Front & Back
>>High Credit Score fullz (700+ Scores)
>>DL number, Employee Details, Bank Details Included
>>Complete Premium Info with Relative Info
***************************************
COMPLETE GUIDE FOR TUTORIALS & TOOLS
"SPAMMING" "HACKING" "CARDING" "CASH OUT"
"KALI LINUX" "BLOCKCHAIN BLUE PRINTS" "SCRIPTING"
"FRAUD BIBLE"
"TOOLS & TUTORIALS LIST"
=>Ethical Hacking Ebooks, Tools & Tutorials
=>Bitcoin Hacking
=>Kali Linux
=>Fraud Bible
=>RAT
=>Keylogger & Keystroke Logger
=>WhatsApp Hacking & Hacked Version of WhatsApp
=>Facebook & Google Hacking
=>Bitcoin Flasher
=>SQL Injector
=>Premium Logs (PayPal/Amazon/Coinbase/Netflix/FedEx/Banks)
=>Bitcoin Cracker
=>SMTP Linux Root
=>Shell Scripting
=>DUMPS with pins track 1 and 2 with & without pin
=>SMTP's, Safe Socks, Rdp's brute
=>PHP mailer
=>SMS Sender & Email Blaster
=>Cpanel
=>Server I.P's & Proxies
=>Viruses & VPN's
=>HQ Email Combo (Gmail, Yahoo, Hotmail, MSN, AOL, etc.)
*Serious buyers will always welcome
*Price will be reduce in bulk order
*Discount offers will give to serious buyers
*Hope we do a great business together
===>Contact 24/7<===
==>Telegram > @leadsupplier
==>ICQ > 752822040
==>Skype > Peeterhacks
==>Wicker me > peeterhacks
What's Up Everyone
DeleteFresh Databases available
CC's CVV's SSN
Pros High Credit Scores 700+
Fullz/Leads with SSN+DOB+DL
Dumps
EIN Leads
Bulk HQ Emails
Office365 Emails & Logs
>>>WA/Telegram +92 317 272 1122
>>>ICQ 752822040
>>>Skype/Wickr @peeterhacks
>>>Email exploit dot tools4u at gmail dot com
Quality Tools & Tutorials available for
HACKING|SPAMMING|CARDING|SPYING|CLONING|CASH-OUTS|TRANSFERS
Legit Fullz/Pros/Leads will be provided
Bulk quantity also
Invalid stuff will be replaced/No refund
BTC & USDT payments mode
Available 24/7
Feel Free to contact Guy's
I rarely share my story with people, not only because it put me at the lowest point ever but because it made me a person of ridicule among family and friends. I put all I had into Binary Options ($690,000) after hearing great testimonies about this new investment
ReplyDeletestrategy. I was made to believe my investment would triple, it started good and I got returns (not up to what I had invested). Gathered more and involved a couple family members, but I didn't know I was setting myself up for the kill, in less than no time all we had put ($820,000) was gone. It almost seem I had set them up, they came at me strong and hard. After searching and looking for how to make those scums pay back, I got introduced to maryshea03@gmail.com to WhatsApp her +15623847738.who helped recover about 80% of my lost funds within a month.
Hey Guys !
ReplyDeleteUSA Fresh & Verified SSN Leads with DL Number AVAILABLE with 99.9% connectivity
All Leads have genuine & valid information
**HEADERS IN LEADS**
First Name | Last Name | SSN | Dob | DL Number | Address | City | State | Zip | Phone Number | Account Number | Bank Name | Employee Details | IP Address
*Price for SSN lead $2
*You can ask for sample before any deal
*If anyone buy in bulk, we can negotiate
*Sampling is just for serious buyers
==>ACTIVE, FRESH CC & CVV FULLZ AVAILABLE<==
->$5 PER EACH
->Hope for the long term deal
->Interested buyers will be welcome
**Contact 24/7**
Whatsapp > +923172721122
Email > leads.sellers1212@gmail.com
Telegram > @leadsupplier
ICQ > 752822040
Email > leads.sellers1212@gmail.com
ReplyDeleteTelegram > @leadsupplier
ICQ > 752822040
ALL TUTORIALS AVAILABLE FOR SPAMMING, CARDING, CASHOUTS, MOBILE DEPOSITS
-->SPAMMING price == 200$
>What you need to start spam
-->CARDING price == 300$ (Includes All Carding)
(How to use eBay Carding, Amazon Carding, Adidas Carding )
>APPLE PAY & ANDROID TAP CASH
>BANK TRANSFER
>BITCOIN CARDING
>WALMART CARDING
-->DUMPS+PINS price == 85$
(How to use & create dumps with pins track 1 & 2)
>HOW TO CASHOUT DUMPS+PINS
>MOBILE DEPOSIT
>SAFE SOCKS5 (USA)
>WESTERN UNION CARDING
>WORLD REMIT CARDING METHOD
-->SMTP Linux Root
*--price ==150$--*
Also SELLING
>SERVER I.P's price == 200$ in bulk
>USA EMAILS with Passwords price ==150$ in bulk
>SSN Fullz with Driving license price == 2$ each
**Contact 24/7**
Email > leads.sellers1212@gmail.com
Telegram > @leadsupplier
ICQ > 752822040
ReplyDeleteAre you desperately in need of a hacker in any area of your life??? then you can contact; ( www.hackintechnology.com services like; -hack into your cheating partner's phone(whatsapp,bbm.gmail,icloud,facebook, twitter,snap chat and others) -Sales of Blank ATM cards. -hack into email accounts and trace email location -all social media accounts, -school database to clear or change grades, -Retrieval of lost file/documents -DUIs -company records and systems, -Bank accounts,Paypal accounts -Credit cards hacker -Credit score hack -Monitor any phone and email address -Websites hacking, pentesting. -IP addresses and people tracking. -Hacking courses and classes CONTACT THEM= hackintechnologyatgmaildotcom or whatsapp +12132951376 their services are the best on the market and 100% security and discreet work is guarante
****Contact Me****
ReplyDelete*ICQ :748957107
*Gmail :taimoorh944@gmail.com
*Telegram :@James307
*Skype : Jamesvince$
SPAMMED&VALID FULLZ WITH ALL PERSONAL DATA+DL NUMBER
-->FULLZ FOR UNEMPLOYMENT BENEFITS
-->FULLZ FOR PUA & SUA
-->FULLZ FOR TAX REFUND
+High quality and connectivity
+If you have any trust issue before any deal you may get few to test
(As legit Vendor)
+Every leads are well checked and available 24 hours
+Fully cooperate with clients
+Any invalid info found will be replaced
+Credit score above 700 every fullz
+Payment Method(BTC,USDT,ETH,LTC & PAYPAL)
+Fullz available according to demand too i.e (format,specific state,specific zip code & specifc name etc..)
*Format of Fullz/leads/profiles
°First & last Name
°SSN
°DOB
°(DRIVING LICENSE NUMBER)
°ADDRESS
(ZIP CODE,ANY STATE,CITY)
°DL State+RESIDENTIAL State
°PHONE NUMBER
°EMAIL ADDRESS
°Relative Details
°Employment status
°Previous Address
°Income Details
°Husband/Wife info
°Mortgage Info
$2 for each fullz/lead with DL num
$1 for each SSN+DOB
$5 for each with Premium info
ID's Photos For any state (back & front)
(Price can be negotiable if order in bulk)
OTHER SERVICES
+(Dead Fullz)
+(Email leads with Password)
+(Dumps track 1 & 2 with pin and without pin)
+Hacking Tutorials
+Smtp Linux
+Safe Sock
+Server I.P's
+HQ Emails with passwords
*Let's do a long business and good profit
Hi Guy's
ReplyDeleteFresh & valid spammed USA SSN+Dob Leads with DL available in bulk.
>>1$ each SSN+DOB
>>2$ each with SSN+DOB+DL
>>5$ each for premium (also included relative info)
Prices are negotiable in bulk order
Serious buyer contact me no time wasters please
Bulk order will be preferable
CONTACT
Telegram > @leadsupplier
ICQ > 752822040
Email > leads.sellers1212@gmail.com
OTHER STUFF YOU CAN GET
SSN+DOB Fullz
CC's with CVV's (vbv & non-vbv)
USA Photo ID'S (Front & back)
All type of tutorials available
(Carding, spamming, hacking, scam page, Cash outs, dumps cash outs)
SMTP Linux Root
DUMPS with pins track 1 and 2
Socks, rdp's, vpn's
Server I.P's
HQ Emails with passwords
Looking for long term business
For trust full vendor, feel free to contact
CONTACT
Telegram > @leadsupplier
ICQ > 752822040
Email > leads.sellers1212@gmail.com
ReplyDeleteHello all
am looking few years that some guys comes into the market
they called themselves hacker, carder or spammer they rip the
peoples with different ways and it’s a badly impact to real hacker
now situation is that peoples doesn’t believe that real hackers and carder scammer exists.
Anyone want to make deal with me any type am available
Available Services
..Wire Bank Transfer all over the world
..Western Union Transfer all over the world
..Credit Cards (USA, UK, AUS, CAN, NZ)
..School Grade upgrade / remove Records
..Spamming Tool
..keyloggers / rats
..Social Media recovery
.. Teaching Hacking / spamming / carding (1/2 hours course)
discount for re-seller
Contact: 24/7
fixitrogers@gmail.com
The Best Casino Sites to Play for Real Money - LuckyClub
ReplyDeleteTop 10 luckyclub.live Best Casino Sites · 888 Casino · 788 Casino · 6.88 Casino · 5.88 Casino. Play for real · LeoVegas Casino · 4.88 Casino.
We have the fresh and valid USA ssn leads
ReplyDelete99% connectivity with quality
====================
*If you have any trust issue you can buy few to test
*Every leads are well checked and available 24 hours
*Fully cooperate with clients
====================
>> SSN+DOB
>> SSN+DOB+DL
>> Premium high score fullz (also included relative info)
====================
TUTORIALS AVAILABLE FOR
SPAMMING
CARDING
CASHOUTS
MOBILE DEPOSITS
>APPLE PAY & ANDROID TAP CASH
>BANK TRANSFER
>HOW TO CASHOUT DUMPS+PINS
>MOBILE DEPOSIT
====================
>SAFE SOCKS5 (USA)
>SMTP Linux Root
-->DUMPS+PINS
(How to use & create dumps with pins track 1 & 2)
=====================
Also SELLING
>SERVER I.P's & proxies in bulk
>USA EMAILS Combo
>Fresh Leads for tax returns & w-2 form filling
>CC's with CVV's (vbv & non-vbv)
>USA Photo ID'S (Front & back)
>Payment mode BTC, ETH, LTC, & USDT
Telegram : @Cyberz_Phoenix
ICQ : @1001829652
WICKR : @cyberzphoenix
The King Casino Online ᐈ Get 50% up to €/$100 + 50 Free Spins
ReplyDeleteGet 50% up ventureberg.com/ to €/$100 + 50 Free https://jancasino.com/review/merit-casino/ Spins · Visit the official site · Log in to your Casino Account · If you do not 출장안마 agree to the terms of the 바카라 terms septcasino.com of the agreement,
Nation_Hackers is a globally well-established group of international Hackers & Spammers.
ReplyDeleteWe tend to confirm by all suggests that necessary that our shoppers get the most
effective of services on A PAYMENT. Instead of send cash and trust a criminal to meet
your deal. You'll get wonderful client service. That's a 100 percent guarantee.
Be careful of people accused of some crimes, like Ponzis. You have been dragged through
the grimy door to become a sadist or another kind of victim. We are always looking for
a way to communicate directly with you. It would always be a Victory for you here. No
doubt, Nation_Hackers offer matchless services that are unparalleled.
Contact:
Telegram : @Nation_Hackers
ICQ : 1003488698
* USA SSN leads / SSN FULLZ Fresh
* CC With CVV (vbv & non-vbv)
* USA I.D Photos Front & Back
* Other I.D Templates
* High Credit Score Fullz
* Bank Logins
* Paypal Logins
* Netflix Logins
* American Express Login
* UAE Bank Logins
* Disney Plus Logins
* HBO max Logins
* VPN Logins
* Bianance Logins
* Coinbase Logins
* Blockchain Logins
* TOOLS
* TUTORIALS
* Ethical Hacking (Tools/Tutorials)
* Bitcoin Hacking
* Kali Linux
* RATS
* Keylogger
* Bitcoin Flasher
* SQL Injector
* SMTP Linux Root
* Shell Scripting
* SMS Sender
* Email Blaster
* Server I.P's & Proxies
* Viruses
* VPN
* Email Combo
* SQL Injector
* CARDING
* Penetration Testing
* SMTP Mailer
* PHP Mailer
* Trojen V
Contact:
Telegram : @Nation_Hackers
ICQ : 1003488698
We are always looking for a way to communicate directly with you.
It would always be a Victory for you here. No doubt,
with none cheap doubts, it's no news that Nation_Hackers supply one amongst the best services.
What's Up Everyone
ReplyDeleteFresh Databases available
CC's CVV's SSN
Pros High Credit Scores 700+
Fullz/Leads with SSN+DOB+DL
Dumps
EIN Leads
Bulk HQ Emails
Office365 Emails & Logs
>>>WA/Telegram +92 317 272 1122
>>>ICQ 752822040
>>>Skype/Wickr @peeterhacks
>>>Email exploit dot tools4u at gmail dot com
Quality Tools & Tutorials available for
HACKING|SPAMMING|CARDING|SPYING|CLONING|CASH-OUTS|TRANSFERS
Legit Fullz/Pros/Leads will be provided
Bulk quantity also
Invalid stuff will be replaced/No refund
BTC & USDT payments mode
Available 24/7
Feel Free to contact Guy's
This comment has been removed by the author.
ReplyDelete