From Demo to Live: Zero-Click Account Takeover via the Same Encryption Algorithm

An encryption algorithm that passes security tests and seems flawless… But once it goes live, imagine accounts being taken over without a single click. So, how did I make this possible?

1) We have a demo environment alongside the target application. Let’s call our target application “redacted.com” and the demo application “demo.com”. The demo environment could also be a subdomain of the live environment, such as “demo.redacted.com”.

2) The demo and live environments have the same UI. While doing some security tests in the demo environment (demo.com), I noticed that all OTP requests sent for before registration had the value “1234”. At first, it seemed like an easy OTP bypass.

3) Then, when I entered “1234” to register to the demo with random phone number, my account was created with this HTTP response below. When I examined the HTTP response, the first thing that came to mind was changing the ID value to see if I could get a different response, but I was unsuccessful at that point. Then, I thought that the access_token value might also be valid in the live environment. I switched to the live environment (redacted.com) and made the same request, replacing this response with the OTP validation result from the live environment.

As a result, the ID values of the accounts I created in the demo were increasing one by one. I saw the value 238 for the next account I created in the demo and was able to take over the account of the 238th user using access_code value. With a simple script, I could take over the accounts of all the users in the live environment, starting from 237, one by one. To do this, all I had to do was enter 1234 in the OTP code response in the demo environment.

Note: All sensitive content belonging to the company has been CENSORED and NO internal company information has been shared in any screenshots.