HOW I ENTERED OTHER USERS MEETING IN ZOHO MEETING:

Seeing the bugs of the zoom meeting, an idea came to my mind that let's play with the zoho meeting. First of all, its functionality is understood. 🤔I myself created the meeting host and joined. I saw the meeting id is numeric (10 digits). It came to my mind that Can I know the meeting id of other users.

Picture 1.0

The first way is to Brute force the meeting id . I used intruder to extract other users meeting id , oh no my ip got blocked for some minutes. Mean rate limiting is in place.

I tried to bypass the rate limit. but no success . i Used every headers like X-Forwarded-For , X-Remote-IP, X-Forwarded-Host , X-Originating-IP. but no success 😒😒.

So I went around the all the headers and cookies values. I Manipulated every cookie value but hey. i see there is a ZMEET_CSRF_TOKEN =x.x.x.x.x.xx IN JOIN REQUEST.I manipulate the ZMEET_CSRF_TOKEN And again hit request . hey I bypassed the rate limit. 😉😉😉

Now time to extract other users meeting id , I used intruder on token and meeting id , i was able to extract min 200 people meeting id .

I HAVE MEETING ID OF OTHER USERS ? an idea came to my mind Can i Join without any restriction. 🤔🤔🤔🤔.

I Simply went to meeting join page , enter any name and meeting id , yeh I can enter it in any meeting.😎🤔🤔😎

Timeline :

April 5, 2020 - Bug Reported to ZOHO

April 10 , 2020 - Status changes to Triaged | Explained how to reproduce the bug

April 23, 2020 - our team is still working on this. We'll get back to you as soon as we have an update

May 9, 2020 - Nice Catch! from ZOHO❤

May 9, 2020- Bounty Awarded $$$

While doing bug bounty you have to check everything in request and response.

Comments

Passcode Protection Bypass By Brute Forcing On zoho (Cliq Application)

First We discuss about what is passcode and Why it is Implemented in Mobile Applications. PASSCODE Implemented in Mobile Application to protect Applications from an Unauthorized Access.like for example your cliq or any application account is logged in mobile phone .any your friend ask you to give phone , your friend try to open cliq application to see your message, but your friend cant open the application without entering passcode . he have to enter passcode for open, so it is an extra layer security in applications. Passcode protection implemented in Android Application is an extra layer security to protect an unauthorized access. How Passcode Protection is bypassed by Bruteforcing? You know that passcode protection or pin protection in mobile applications have some attempt to enter passcode , if you enter wrong passcode more than 5 times or 10 times based on application security , User logged out automatically and redirected to login page.but due to some ...

A New Way Of Brute force Passcode/Pin Protection By deep link

DESCRIPTION : AS you know already that what is passcode protection and why it is applied ? And how it is bypassed normally ? If you don’t know please read my previous blog: https://negativewives.blogspot.com/2020/04/passcode-protection-bypass-by-brute.html When any passcode protection is implemented first check any activity is exported or not ? Here we only talking the scenario where no activity is exported in application PROCEDURE : Open Application after implementing passcode protection. You see that passcode activity is launched first Go to AndroidMainfest.xml file and check launch mode of passcode activity . Question Arises in your mind - ...

ZIP Symlink Vulnerability

What is Symlink? A symlink (also called a symbolic link) is a type of file in Linux that points to another file or a folder on your computer. Symlinks are similar to shortcuts in Windows There are two types of symlinks Soft and Hard Link A symbolic or soft link is an actual link to the original file, whereas a hard link is a mirror copy of the original file. If you delete the original file, the soft link has no value, because it points to a non-existent file. But in the case of hard links, it is entirely the opposite. Even if you delete the original file, the hard link will still have the data of the original file. Because hard link acts as a mirror copy of the original file For know more about the symlink please visit: https://ostechnix.com/explaining-soft-link-and-hard-link-in-linux-with-examples/ What is ZIP SYMLINK Vulnerability? An archive can contain a symbolic link. A symbolic link is a special file that links to another file. By uploading a zip containing a symbo...

NegativeWibes

Search This Blog