Tuesday , November 21 2017
Home / News / Vulnerability Twitter Hapus Kartu Kredit dari Semua Akun

Vulnerability Twitter Hapus Kartu Kredit dari Semua Akun

Seperti sosial media lainnya, twitter membayar setiap individual yang dapat menemukan kelemahan pada layanan situs mereka dengan biaya sebesar $140 atau lebih untuk setiap kelemahan yang ditemukan di bawah program barunya Bug Bounty.

Seorang peneliti security dari Mesir Ahmed Mohamed Hassan Aboul-Ela yang telah banyak dihargai oleh perusahaan besar seperti google. Microsoft dan Apple, telah menemukan Vulnerability yang cukup serius dari layanan iklan twitter yang memungkinkan dia menghapus kartu kredit dari akun twitter.

Vulnerability yang pertama, Awalnya Abolul-Ela menemukan dua Vulnerability yang berbeda pada ads.twitter.com, namun kedua kelemahan tersebut memiliki dampak dan efek yang sama, kelemahan pertama berada pada fungsi delete kartu kredit dalam halaman metode pembayaran. https://ads.twitter.com/accounts/[account id]/payment_methods. Dengan memilih fungsi Delete this card, sebuah permintaan ajax POST request dikirim ke server. Parameter POST request yang dikirim adalah nama akun dan ID akun twitter. Respon halaman “403 forbidden” tetapi sebenarnya, kartu kredit telah terhapus dari akun twitter.

“Yang harus saya lakukan adalah mengubah dua parameter untuk ID akun twiiter dan kartu kredit saya yang lain, lalu membalas lagi request dan saya tiba-tiba menemukan kartu kredit telah terhapus dari akun twitter yang lainnya tanpa interaksi yang diperlukan.” Tulis Aboul-Ela.

Vulnerability yang kedua, Aboul menemukan kelemahan lain yang serupa pada ads.twitter.com, namun menurut dia dampak vulnerability ini lebih tinggi dari yang sebelumnya.

Ketika dia mencoba menambahkan kartu kredit yang tidak valid ke akun twitternya, ditampilkan pesan kesalahan “We were unable to approve the card you entered” dan menyediakan tombol “dismiss”, mengklik pada tombol, kartu kredit hilang dari akunnya.

“Saya pikir itu memiliki efek yang sama dari menghapus, jadi saya mencoba untuk menambahkan kartu kredit yang tidak valid lagi dan mencegat request” katanya.

Tidak seperti Vulnerability pertama, parameter akun tidak , hanya ID kartu kredit yang digunakan. Dia memodifikasi ID kartu kredit di URL dan body untuk ID kartu kredit dari akun twitter lain dan kemudian menjawab request tersebut.

Lalu apa yang terjadi? Coba tebak sendiri.

56 comments

  1. I wish to convey my gratitude for your kindness for visitors who absolutely need assistance with that idea. Your real dedication to passing the message all over had been pretty practical and has without exception enabled associates much like me to realize their targets. Your own warm and friendly key points indicates a lot to me and extremely more to my mates. With thanks; from each one of us.

  2. 402477 862633Great post, nicely put together. Thanks. I will probably be back soon to take a look at for updates. Cheers 857056

  3. 189941 198655How much of an appealing guide, keep on making better half 117887

  4. Awesome, this can be an brilliant part of create which i’ve obtain around endless original. Actually do sometimes head to my own web page.

  5. Which i dont commonly post on many another Blogs, still I merely must give you thanks to the public may be the solid foundation for charity sustain the astounding work. Ok unfortunately it is time to arrive at my work.

  6. Free Juegos de mario bros -play free Juegos de mario bros in your own home! The online world now hosts several 1000s of online arcades where free Juegos de mario bros take the market, Twenty four hours every day! A person with a sophisticated computer or laptop can start to play free Juegos de mario bros via their web browser. Now you are prepared to experiment with some free Juegos de mario bros online! Depending on your age and design, you can find endless fun and addicting free Juegos de mario bros to experience.

  7. Hello! Can you use Twitter? Id prefer to follow you if will be okay. Im undoubtedly enjoying your site and check toward new updates.

  8. Sorry for the huge review, but I’m really loving the new Zune, and hope this, as well as the excellent reviews some other people have written, will help you decide if it’s the right choice for you.

  9. 233620 107048Intriguing internet site, i read it but i nonetheless have some questions. shoot me an e-mail and we will speak far more becasue i could have an intriguing notion for you. 803982

  10. I simply want to mention I’m new to weblog and truly loved your web site. Likely I’m planning to bookmark your site . You really have good writings. Thanks for sharing your website page.

  11. I simply want to mention I’m very new to blogging and site-building and seriously liked you’re website. Probably I’m planning to bookmark your blog post . You surely have terrific writings. Kudos for revealing your web site.

  12. I simply want to say I am just beginner to blogs and absolutely savored your blog site. More than likely I’m going to bookmark your blog post . You absolutely come with really good posts. Many thanks for sharing with us your blog site.

  13. Might be almost unattainable to come across well-informed visitors on this area, regrettably you come across as like you fully understand exactly what you’re posting on! Thank You

  14. We really hope to share it with you the fact that I am certain fresh to posting and genuinely valued your article. More than likely I am most likely to remember your post post . You indeed have great article posts. Delight In it for discussing with us your blog write-up.

  15. It certainly is near unthinkable to find well-updated men or women on this niche, and yet you seem like you know the things that you’re writing on! Regards

  16. It certainly is nearly impossible to see well-aware readers on this subject, however, you look like you comprehend what exactly you’re writing about! Thanks A Lot

  17. I simply wish to inform you you the fact that I am inexperienced to blog posting and undeniably admired your website. Very likely I am likely to remember your article post . You definitely have superb article stuff. Be Grateful For it for swapping with us your url webpage.

  18. You’ll find it mostly unthinkable to encounter well-aware viewers on this matter, however you look like you realize what you’re writing about! Regards

  19. I simply have to notify you that I am novice to putting up a blog and thoroughly cherished your work. Most likely I am inclined to bookmark your webpage post . You undoubtedly have outstanding article posts. Get Pleasure From it for giving out with us your internet site information.

  20. It’s nearly extremely difficult to come across well-advised women and men on this subject, then again you come across as like you be aware of those things you’re covering! Thank You

  21. We simply need to reveal to you which I’m just new to writing and utterly cherished your work. Very likely I am prone to remember your web post . You undoubtedly have fantastic article material. Like it for discussing with us your internet information.

  22. I simply want to mention I’m very new to blogging and site-building and really savored you’re web blog. Likely I’m going to bookmark your blog post . You definitely come with awesome article content. Thanks for sharing with us your web-site.

  23. It’s mostly impossible to see well-informed individual on this content, nevertheless you look like you are familiar with the things that you’re writing about! Thanks A Lot

  24. After exploring a handful of the blog posts on your site, I seriously appreciate your technique of writing a blog. I book-marked it to my bookmark website list and will be checking back in the near future. Please visit my website too and tell me how you feel.

  25. Established in 1994 by the businessman Matteo Rigamonti as a service bureau for traditional printing, and transformed into an e-Commerce printing company in 2000. The new millennium marked a turning point for Pixartprinting who addresses the market with the web-to-print formula, thus modifying over the time a traditional workflow into a totally industrial one. At the time it was an innovative business model, implemented in a mature market, which has allowed, during the years, to achieve undisputed leadership in Italy, together with a plan to expand across the border

  26. I’m really inspired together with your writing abilities as well as with the structure in your blog. Is this a paid subject or did you customize it your self? Either way stay up the nice high quality writing, it is rare to see a nice blog like this one today..

  27. Someone essentially help to make significantly articles I would state. This is the very first time I frequented your web page and so far? I amazed with the analysis you made to create this particular post amazing. Excellent activity

  28. Passetoncode.fr est un site d’entraînement à l’examen du code de la route entièrement gratuit. Testez vous sur 40 questions dans les conditions réelles d’examen ou par séries de 20 questions sur un thème de votre choix. Vous apprenez à votre rythme et pouvez suivre votre progression grâce à des statistiques détaillées.

  29. Thanks a lot for sharing this with all of us you really know what you’re talking about! Bookmarked. Please also visit my website =). We could have a link exchange contract between us!

  30. Il n’est donc pas utile de consulter les prévisions météo à plus long terme. Le relief de la Martinique influant beaucoup sur le climat, je vous conseil de consulter la météo avant vos déplacements. En effet, il est courant de noter un écart de température de 6 à 10 degrés entre les villages d’altitude et les côtes.

  31. Just wish to say your article is as amazing. The clearness in your post is just excellent and i can assume you are an expert on this subject. Well with your permission let me to grab your RSS feed to keep up to date with forthcoming post. Thanks a million and please keep up the rewarding work.

  32. Someone necessarily help to make significantly articles I’d state. This is the very first time I frequented your website page and up to now? I amazed with the analysis you made to create this actual put up amazing. Great task

  33. Back the Best offers win or each way tips for horse racing by email normally the night before racing. Selection criteria looks for horses that bookmakers find difficult to price.

  34. I want to to thank you for this excellent read!! I absolutely enjoyed every bit of it. I have you book-marked to look at new stuff you post…

  35. Le teck est un arbre tropical qui donne un bois à la fois très intéressant en terme de mobilier de part son aspect et son coté imputrescible et très contesté car souvent l’objet de trafic notamment de la part du régimes dictatorial de la Birmanie. Néanmoins, l’interdiction de sa coupe sauvage dans de nombreux pays et sa relative facilité de culture industrielle font que cet arbre retrouve une image de plus en plus positive.

  36. Definitely believe that which you said. Your favorite justification seemed to be on the internet the simplest thing to be aware of. I say to you, I certainly get annoyed while people think about worries that they plainly don’t know about. You managed to hit the nail upon the top and defined out the whole thing without having side-effects , people can take a signal. Will probably be back to get more. Thanks

  37. Wow, awesome blog layout! How long have you been blogging for? you make blogging look easy. The overall look of your web site is magnificent, as well as the content!

  38. Somebody essentially lend a hand to make critically articles I would state. That is the very first time I frequented your web page and to this point? I amazed with the research you made to create this particular put up amazing. Great activity

  39. 963370 853528Thank you for the sensible critique. Me and my neighbor were just preparing to do some research on this. We got a grab a book from our location library but I feel I learned far more clear from this post. I

  40. Wow, wonderful blog layout! How long have you been blogging for? you make blogging look easy. The overall look of your web site is great, as well as the content!

  41. How to apply a wordpress theme downloaded from other websites?

  42. Hello there! This article couldn’t be written much better! Reading through this post reminds me of my previous roommate! He continually kept talking about this. I’ll forward this article to him. Pretty sure he will have a great read. Thank you for sharing!

  43. My Partner And I simply desire to reveal to you that I’m just inexperienced to putting up a blog and clearly loved your work. Probably I am prone to store your site post . You absolutely have magnificent article text. Delight In it for expressing with us your url report.

  44. trying to determine whether my company blog should be housed on corp. website or using different platform like Blogspot? The goal is to drive as much qualified traffic to the “new” corp. website as possible. Also, what would be better from an SEO perspective?.

  45. I simply have to tell you in which I am certain beginner to posting and incredibly cherished your page. Most likely I am going to remember your webpage post . You undoubtedly have stunning article subject. Like it for swapping with us your website write-up.

  46. We have been also observing of which standard health professionals can also be realizing the increased involvement in cutting edge of using recovery and so are ultimately noticed that you incorporate most of these recovery procedures to their training to keep up with the current tendencies. There are lots of means to get a structure job interview, but some are more useful than people.

  47. It really is almost unattainable to come across well-informed individuals on this theme, however you come across as like you are familiar with which you’re raving about! With Thanks

Leave a Reply

Your email address will not be published. Required fields are marked *

*

You might also likeclose
Free WordPress Themes - Download High-quality Templates