Instagram’s New Security Tools are a Welcome Step, But Not Enough

Instagram users should soon have more secure options for protecting their accounts against Internet bad guys. On Tuesday, the Facebook-owned social network said it is in the process of rolling out support for third-party authentication apps. Unfortunately, this welcome new security offering does...

Whatsapp Automation - A Collection Of Tools For Sending And Recieving Whatsapp Messages

Whatsapp Automation is a collection of APIs that interact with WhatsApp messenger running in an Android emulator, allowing developers to build projects that automate sending and receiving messages, adding new contacts and broadcasting messages multiple contacts. The project uses Selinium, Appium,...

How to Fight Mobile Number Port-out Scams

T-Mobile, AT&T and other mobile carriers are reminding customers to take advantage of free services that can block identity thieves from easily "porting" your mobile number out to another provider, which allows crooks to intercept your calls and messages while your phone goes dark. Tips for...

Tai Financial App has an arbitrary cell phone number registration loophole

Tai Financial App is an investment and financial management software. There is an arbitrary cell phone number registration vulnerability in Tai Wealth Management APP. Attackers can register any account and perform unauthorized operations by bypassing the authentication code through grabbing packe...

Instant Judgment Android app has arbitrary cell phone number login vulnerability

Instant Judgment app is a life service application, which is an automobile service platform built by Six Points North Technology. Instant Judge Android app has arbitrary cell phone number login leakage. Attackers only need other people's cell phone numbers to log into other accounts...

Khan Academy: No Security check at changing password and at adding mobile number which leads to account takeover and spam

Description I have noticed that there is no security check at changing password. If someone gets a logged in account for 5 seconds, they are extremely likely to change the password of the account with the knowledge of the victim. also, while adding a mobile number / changing a mobile number, ther...

Grab: Authorization bypass using login by phone option+horizontal escalation possible on Grab Android App

Description: After my previous report about 2FA bypass on the Profile Edit endpoint i was interested to find enpoint, which will allow me horizontal privileges escalation. So, I found the endpoint using android app https://p.grabtaxi.com/api/passenger/v2/profiles/activationsms which allow me to...

Slack: CSRF - Add optional two factor mobile number

Description ==================== Adding a mobile number for 2-factor authentication is vulnerable to CSRF, allowing an attacker to bypass 2-factor authentication. An attacker would be able to force the logged in user to add a new mobile number for 2-factor authentication. The attacker would then...

Uber: Uber is Flooding my Mobile with SMS Daily like a cron JOB

The Issue is with the design of sending SMS by the uber referrals system, and every day it's flodding my phone number with driver invitaion message To reproduce this scenario i have Fuzz the below request Through OWSAP Zap I fuzzed for 10,000 requests , keep the same Phone number I have used my...

FreedomPop Account Hijacking Flaws Remain Unpatched

It took close to two months, but free wireless and mobile provider FreedomPop has acknowledged reports of a serious vulnerability in its service. U.K.-based researcher Paul Moore told Threatpost that FreedomPop, which has been operating in the U.K. since last September, finally responded to a bug...

Mobile Number Locator - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Mobile Number Locator published at the 'play' market has multiple vulnerabilities...

Mobile Number Tracker - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Mobile Number Tracker published at the 'play' market has multiple vulnerabilities...

Mobile Number Tracker on Map - External URLs, SD-card access, SQLite database found vulnerabilities

HackApp vulnerability scanner discovered that application Mobile Number Tracker on Map published at the 'play' market has multiple vulnerabilities...

Mobile Number Tracker - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Mobile Number Tracker published at the 'play' market has multiple vulnerabilities...

site2sms.com XSS vulnerability

Open Bug Bounty ID: OBB-60743 Description| Value ---|--- Affected Website:| site2sms.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Sophos Cyberoam add_guest_user Blind SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary SQL on vulnerable installations of Sophos Cyberoam. Authentication is not required to exploit this vulnerability. The specific flaw exists within the addguestuser opcode. The issue lies in the failure to properly sanitize the specifi...

Mail.ru: Unproper usage of Mobile Number that will lead to Information Disclosure

We know that our mobile number is connected to some subdomains of mail.ru like calendar, cloud and etc. I found out that using 1 Mobile Number can create or use it to MANY ACCOUNTS. This is what I did.. I have a main account in mail.ru Email: [email protected] with Mobile Number of: 639154219078...

Twitter SMS-Spoofing Bug Allows Attackers to Send Tweets From Users' Accounts, Edit Profiles

There is a bug in the way that Twitter handles a feature that enables users to post messages via SMS and the researcher who discovered the bug says that it allows anyone who knows a user’s mobile number to not only tweet from the user’s account but also modify information in the user’s profile. T...