Snapchat: Exposed Kubernetes API - RCE/Exposed Creds

@txt3rob found one of Snaps internal Kubernetes instances exposing an API endpoint without authorization to the public. With access to this API he was able to run arbitrary code/jobs as a cluster-admin and gained access to credentials with internal access to a significant number of instances...

Snapchat: Github Token Leaked publicly for https://github.sc-corp.net

Description : GitHub is a truly awesome service but it is unwise to put any sensitive data in code that is hosted on GitHub and similar services as i was able to find github token indexed 7 hours Ago by user ██████ - Software Engineer - Snap Inc Issue & POC : You can find the leak in this link :...

Snapchat: Domain Takeover in [obviousengine.com] a snapchat acquisitions

Hello, Summary while searching in snapchat acquisitions i found obviousengine moe information here https://www.crunchbase.com/organization/obvious-engineeringsection-overview and i found that it's pointing to Github page so i claimed it POC - when i visit it was look like F331040 - i successfully...

Hacker leaks Snapchat’s source code on Github

By Waqas Pakistani Hacker Posted Authentic Snapchat Source Code on GitHub - Snapchat’s source code is stolen…can there be a bigger news than that? Perhaps there is! Not only that the source code has been stolen but also posted on Microsoft-owned GitHub of all the platforms. Reportedly, the hacker...

Snapchat Hack — Hacker Leaked Snapchat Source Code On GitHub

The source code of the popular social media app Snapchat was recently surfaced online after a hacker leaked and posted it on the Microsoft-owned code repository GitHub. A GitHub account under the name Khaled Alshehri with the handle i5xx, who claimed to be from Pakistan, created a GitHub reposito...

Snapchat Hack — Hacker Leaked Snapchat Source Code On GitHub

The source code of the popular social media app Snapchat was recently surfaced online after a hacker leaked and posted it on the Microsoft-owned code repository GitHub. A GitHub account under the name Khaled Alshehri with the handle i5xx, who claimed to be from Pakistan, created a GitHub reposito...

Snapchat: Client IP Spoofing using "X-Forwarded-For: 127.0.0.1" on "studio-app.snapchat.com" exposing bucket details

Researcher's summary is accurate. An attacker could view a variety of non-sensitive service config information by setting the X-Forwarded-For: 127.0.0.1 header on a specific service path. By adding "X-Forwarded-For: 127.0.0.1" as a header while requesting a certain path on a certain snapchat...

A week in security (February 12 – February 18)

Last week on Malwarebytes Labs, we looked at a huge Android cryptomining campaign, malicious apps on Google Play, and some Apple scams doing the rounds. We also explored the world of healthcare security, and dived into the land of scammy Valentine's Day tricks and cheats. Other news Thought the...

Snapchat: Takeover 2 MAIN DOMAINS of a company Acquired by Snapchat

Hi, As you may realize I noted "Domain" and not subdomain because actually, I was able to take over the MAIN domain of a company Acquired by Snapchat. As you can see in the screenshot below, when you type "Addlive" in Google https://goo.gl/EAxBaj , the first two results will be: F261984 First one...

Snapchat: Publicly accessible Continuous Integration Tool

@apfeifer27 found an internal Continuous-Integration instance, which disclosed internal source code and credentials for some of our instances...

Snapchat: Bitmoji source code is accessible

hi team, I'm starting my research on snapchat by scanning all sub-domains on all the domains in-scope: snapchat.com, bitmoji.com, etc. Let's look at one of the urls, https://rendering-service.prod.us-east.bitstrips.com/ When I request GET https://rendering-service.prod.us-east.bitstrips.com/ The...

iOS < 11.1 / tvOS < 11.1 / watchOS < 4.1 - Denial of Service Exploit

Exploit for iOS platform in category dos / poc Exploit Title: TpwnT - iOS Denail of Service POC Date: 10-31-2017 Exploit Author: Russian Otter Ro Vendor Homepage: https://support.apple.com/en-us/HT208222 Version: 2.1 Tested on: iOS 10.3.2 - 11.1 CVE: CVE-2017-13849 """ -------------------------...

iOS < 11.1 / tvOS < 11.1 / watchOS < 4.1 - Denial of Service

Exploit Title: TpwnT - iOS Denail of Service POC Date: 10-31-2017 Exploit Author: Russian Otter Ro Vendor Homepage: https://support.apple.com/en-us/HT208222 Version: 2.1 Tested on: iOS 10.3.2 - 11.1 CVE: CVE-2017-13849 """ ------------------------- CVE-2017-13849 TpwnT by Ro of SavSec...

Snapchat: Subdomain Takeover via Unclaimed WordPress site

@ysx found a bitstripsforschools CNAME entry pointing to an unclaimed WordPress domain, which could be taken over by an external party. The CNAME entry was for a product that is no longer active. An unclaimed WordPress domain mapping upgrade could be leveraged to assume the...

Snapchat: Subdomain Takeover via unclaimed UserVoice domain

@benocular found a bitstripsforschools CNAME entry pointing to an unclaimed UserVoice domain, which could be taken over by an external party. The CNAME entry was for a product that is no longer active...

Snapchat: Stealing SSO Login Tokens (snappublisher.snapchat.com)

Description Attacker can steal SSO login tokens for snappublisher.snapchat.com by chaining different flaws in SSO and Snapchat’s Snappublisher tool. Detailed attack flow is as follows. Attack Flow 1.. Snapchat fetches a SSO LOGIN TOKEN from accounts.snapchat.com to login into different products o...

Snapchat: RCE/LFI on test Jenkins instance due to improper authentication flow

@nahamsec found a test Jenkins instance where they could login with any valid Google account. Once logged in, they gained the ability to execute arbitrary code via the Jenkins Script Console. This was a test jenkins instance with no access to source code or resources. Methodology Here is the...

SnapSaver for Snapchat - Dynamic Code Loading, External URLs, Possible privilege escalation vulnerabilities

HackApp vulnerability scanner discovered that application SnapSaver for Snapchat published at the 'play' market has multiple vulnerabilities...

Snapchat: [spectacles.com] Bypassing quantity limit in orders

Hi Snapchat team, In the https://www.spectacles.com the quantity of orders has limited for spectacles is 6 and for accessories is 10 according to help support page. But it can easily be manipulated by editing the URL. Problem originates from limiting the quantity of the items is with just the UI...

Snapchat - Dynamic Code Loading, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Snapchat published at the 'play' market has multiple vulnerabilities...