Member-only story
Business Logic Flaw worth $1250
Ciao hackers, I hope you’re hacking well. In this write-up, I’m going to share a business logic flaws on a crypto wallet website that can lead to the takeover of any victim’s wallet account. I will be using redacted.com as the main domain.
The company is a crypto wallet to earn, buy, store, and stake tokens.
The front end of the application is at app.redacted.tv and all the backend APIs are at api.redacted.tv. As usual, I fired up my burp suite and started exploring the application.
I created an account on the website, to verify email an email verification code is being sent to given email address. I verified the account and on the next page, 2FA is compulsory to set up. After finishing up the registration my account is ready to use. Below is the flow of registration:
1. Enter Name, Email address and Password
2. Enter verification code on verify email page
3. Setup 2FA
4. Logged in to the account.In the step of verification of email, I notice that the URL is https://app.redacted.tv/verify?email=user@gmail.com. I thought, let’s open this URL in an incognito tab or another browser. After forced browsing the URL the verification page opened without entering password and asked for the verification code.
