User agent spoofing in email notification

User agent spoofing in email notification – Bug Bounty POC

user agent Spoofing Vulnerability

Hello Bug Bounty Poc Viewers, This is Behroz and today i will share one of my old finding on itbit that how i found User agent spoofing in email notification,The impact of this vulnerability was any one can send his malware link in notification email to user just by one unsuccessful login attempt.

While testing itbit i found that Itbit sent failed login notification to user upon every unsucessful login attempt containing the user-agent,ip of user ( who is trying to login) and time of login attempt.so i did an unsucccesful login and intercept the request using proxy tool ( burp suite) and find out that the user-agent was changable.now i just change the user-agent in strings and forward the request :

POST /login HTTP/1.1
Host: exchange.itbit.com
User-Agent: for more: evil.com Firefox/41.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://exchange.itbit.com/login
Cookie: _ga=GA1.2.560433933.1459265794; _ga=GA1.3.416dffa8-540a-4179-8dff-a24e0e6873a9; mp_58b450bf11a452b210eaead39606f34f_mixpanel=%7B%22distinct_id%22%3A%20%22416dffa8-540a-4179-8dff-a24e0e6873a9%22%2C%22%24initial_referrer%22%3A%20%22https%3A%2F%2Fexchange.itbit.com%2Flogin%22%2C%22%24initial_referring_domain%22%3A%20%22exchange.itbit.com%22%7D; _gat=1; itBit.b=s%3Aad4d4954-d840-4770-8a48-e04a42e1e7ae.w3Ch7tZ%2FOdKQqd5AezHUthl0fQzOOOgnMKlbo7qIlTo; itBit.c=1XqktRAY2B0jsHjEL0b7Df4X; itBit.s=s%3A92c83bbb-dd9f-46a9-a3e8-aae06faae173.%2Bxv8uihkz8MLB2QtADvfpLSS8zr0L1NjLV9Qx%2BFqgIk
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 1090

 

after forwarding request i check my email and i got the motified user-agent in mail which i change there 😀

User agent spoofing in email notification

User agent spoofing in email notification

i was like :
Mike-Tyson-clapping-and-laughing
User agent spoofing in email notification Bounty :

User Agent Spoofing in itbit
 not satisfy with bounty for this bug.

You may also like...

53 Responses

  1. Hi there, You’ve done a great job. I will certainly digg it and personally suggest to my friends.
    I am confident they’ll be benefited from this site.

  2. Hello to every one, the contents existing at this website are really remarkable for people experience, well, keep up the good work fellows.

  3. hello there and thank you for your info – I have certainly picked up something new from right here.
    I did however expertise several technical points using this site, as I experienced to reload the website
    many times previous to I could get it to load properly.
    I had been wondering if your web host is OK?
    Not that I am complaining, but sluggish loading instances times will very frequently
    affect your placement in google and could damage your quality score if advertising and marketing
    with Adwords. Anyway I am adding this RSS to
    my email and can look out for much more of your respective interesting content.

    Ensure that you update this again soon.

  4. I just want to tell you that I am just beginner to blogging and honestly liked your blog. More than likely I’m likely to bookmark your blog post . You actually come with fantastic posts. Thanks a lot for revealing your blog site.

  5. I just want to say I’m very new to weblog and really enjoyed this website. Likely I’m going to bookmark your site . You really come with amazing posts. Thanks for sharing with us your website.

  6. Thank you for the auspicious writeup. It in fact was a amusement account it. Look advanced to far added agreeable from you! By the way, how can we communicate?

  7. Sprawdz says:

    I really enjoy yout article. Good job:-)!

  8. Carlos Simi says:

    I went over this website and I think you have a lot of fantastic info, saved to favorites (:.

  9. whoah this blog is great i love reading your articles. Keep up the great work! You realize, a lot of individuals are looking round for this information, you can aid them greatly.

  10. This text is worth everyone’s attention. How can I find out more?

  11. Car Audio says:

    There is clearly a bunch to know about this. I assume you made certain nice points in features also.

  12. Hi, I do believe this is an excellent blog. I stumbledupon it 😉 I will revisit yet again since i have book-marked it. Money and freedom is the best way to change, may you be rich and continue to help others.

  13. Painters  says:

    Great blog here! Also your web site loads up very fast! What host are you using? Can I get your affiliate link to your host? I wish my site loaded up as fast as yours lol

  14. How do you find time to post amazing stuff like this all the time?

  15. Hello, Neat post. There is a problem together with your web site in web explorer, might test this¡K IE nonetheless is the marketplace chief and a big part of folks will omit your fantastic writing because of this problem.

  16. Hello my friend! I wish to say that this post is awesome, nice written and include approximately all vital infos. I would like to see more posts like this .

  17. Business  says:

    I was suggested this blog by my cousin. I am not sure whether this post is written by him as no one else know such detailed about my difficulty. You are amazing! Thanks!

  18. Auto Engine says:

    I would like to thank you for the efforts you’ve put in writing this site. I am hoping the same high-grade site post from you in the upcoming also. In fact your creative writing skills has encouraged me to get my own web site now. Really the blogging is spreading its wings fast. Your write up is a great example of it.

  19. Auto Parts says:

    certainly like your website however you need to test the spelling on several of your posts. Many of them are rife with spelling issues and I to find it very troublesome to tell the reality then again I will surely come again again.

  20. You can certainly see your enthusiasm within the work you write. The world hopes for even more passionate writers such as you who aren’t afraid to say how they believe. All the time follow your heart.

  21. Plumbing  says:

    Its like you read my mind! You appear to know a lot about this, like you wrote the book in it or something. I think that you can do with some pics to drive the message home a little bit, but instead of that, this is great blog. An excellent read. I will definitely be back.

  22. I like what you guys are up also. Such clever work and reporting! Carry on the excellent works guys I¡¦ve incorporated you guys to my blogroll. I think it’ll improve the value of my site 🙂

  23. wonderful put up, very informative. I wonder why the other experts of this sector don’t understand this. You should continue your writing. I’m confident, you’ve a huge readers’ base already!

  24. New Car says:

    Very efficiently written post. It will be valuable to everyone who utilizes it, including yours truly :). Keep doing what you are doing – for sure i will check out more posts.

  25. Auto Parts says:

    It¡¦s really a nice and useful piece of info. I¡¦m glad that you shared this useful information with us. Please keep us informed like this. Thank you for sharing.

  26. I’m not sure where you’re getting your information, but good topic. I needs to spend some time learning more or understanding more. Thanks for magnificent information I was looking for this information for my mission.

  27. new gadgets says:

    I am so happy to read this. This is the kind of manual that needs to be given and not the random misinformation that is at the other blogs. Appreciate your sharing this greatest doc.

  28. vip printing says:

    Way cool! Some extremely valid points! I appreciate you writing this article and also the rest of the site is also very good.|

  29. Airlines  says:

    I loved as much as you’ll receive carried out right here. The sketch is attractive, your authored subject matter stylish. nonetheless, you command get got an shakiness over that you wish be delivering the following. unwell unquestionably come further formerly again as exactly the same nearly very often inside case you shield this hike.

  30. Hey There. I found your blog using msn. This is a really well written article. I’ll be sure to bookmark it and return to read more of your useful info. Thanks for the post. I will certainly comeback.

  31. I think other web site proprietors should take this web site as an model, very clean and magnificent user genial style and design, as well as the content. You’re an expert in this topic!

  32. web says:

    Why viewers still use to read news papers when in this technological globe all is presented on net?|

  33. Motorcycle says:

    I am continually invstigating online for tips that can assist me. Thx!

  34. Home Accents says:

    I am always browsing online for posts that can aid me. Thanks!

  35. Hi my loved one! I wish to say that this article is awesome, nice written and come with approximately all important infos. I¡¦d like to look extra posts like this .

  36. Hello.This post was really remarkable, especially because I was browsing for thoughts on this issue last Friday.

  37. HVAC  says:

    I am glad for commenting to make you know of the remarkable encounter my cousin’s child experienced visiting your site. She mastered several details, which included how it is like to possess an awesome teaching character to get others really easily know just exactly a variety of tricky subject matter. You really exceeded my desires. Thank you for distributing those precious, trustworthy, explanatory and easy tips on that topic to Mary.

  38. I would like to show appreciation to the writer for rescuing me from such a incident. After searching throughout the the net and getting tricks which are not beneficial, I believed my entire life was well over. Existing without the presence of approaches to the problems you’ve resolved by way of your entire site is a serious case, and the ones which may have badly affected my entire career if I had not encountered your blog. Your primary natural talent and kindness in handling every part was very useful. I don’t know what I would’ve done if I had not come across such a subject like this. I am able to at this moment relish my future. Thanks for your time very much for the expert and effective guide. I won’t think twice to recommend your web sites to any person who should receive guidelines on this matter.

  39. I haven¡¦t checked in here for some time because I thought it was getting boring, but the last several posts are great quality so I guess I¡¦ll add you back to my daily bloglist. You deserve it my friend 🙂

  40. Everyone loves what you guys are up too. Such clever work and reporting! Keep up the wonderful works guys I’ve added you guys to our blogroll.|

  41. I am just writing to make you know what a awesome discovery my wife’s princess developed visiting your site. She picked up such a lot of issues, which include how it is like to have a great teaching spirit to make other people without hassle learn about certain impossible topics. You undoubtedly did more than people’s desires. I appreciate you for presenting those useful, trustworthy, revealing and also easy guidance on the topic to Tanya.

  42. You could definitely see your enthusiasm within the work you write. The world hopes for even more passionate writers such as you who aren’t afraid to mention how they believe. Always go after your heart.

  43. Modern Sofa says:

    magnificent publish, very informative. I wonder why the opposite specialists of this sector do not realize this. You should continue your writing. I’m confident, you have a great readers’ base already!

  44. I’ve been surfing online more than 3 hours today, yet I by no means discovered any fascinating article like yours. It is beautiful value enough for me. In my opinion, if all website owners and bloggers made good content as you probably did, the web will likely be much more useful than ever before.

  45. Definitely, what a splendid blog and informative posts, I will bookmark your website.Have an awsome day!

  46. I am says:

    Thank you for sharing superb informations. Your web-site is very cool. I am impressed by the details that you have on this blog. It reveals how nicely you understand this subject. Bookmarked this web page, will come back for extra articles. You, my friend, ROCK! I found just the information I already searched all over the place and simply could not come across. What a great web-site.

  47. Recreational says:

    I have not checked in here for some time since I thought it was getting boring, but the last several posts are good quality so I guess I will add you back to my everyday bloglist. You deserve it my friend 🙂

  48. Hi there, simply turned into aware of your blog thru Google, and located that it is truly informative. I’m going to watch out for brussels. I’ll appreciate in the event you proceed this in future. Many folks can be benefited from your writing. Cheers!|

  49. Does your blog have a contact page? I’m having problems locating it but, I’d like to shoot you an email. I’ve got some suggestions for your blog you might be interested in hearing. Either way, great website and I look forward to seeing it improve over time.

  50. Well I really enjoyed studying it. This information offered by you is very helpful for good planning.

Leave a Reply

Your email address will not be published. Required fields are marked *