FirstBlood-#169 — Found a way to register as non-admin user
This issue was discovered on FirstBlood v1.0.0
On 2021-05-11, iffu reported:
This is by far the most frustrating bug I've ever found. This register bug took a lot of time for me.
Things I tried
Bruteforced the invite codes for 4 digits, 6 digits as in most cases invite codes are of 4 or 6 digits. I used intruder with a very less number of threads so as to not make the server run down.
Tried every possible invite code generation functions from stackoverflow, and what not.
Analysed the whole target for any .js file or .php file for the invite_code generation function or any other function related to invite_code.
After a lot of things tried, one of my friends suggested me to hack it like a real target. I started with google dorking and found the invite code.
Steps to reproduce
- The invite code is publicly available on the internet on www.reddit.com
- The google dork used : site: firstbloodhackers.com invite
Thanks zseano for this wonderful application and please let me know if you need anymore info regarding this.
FirstBlood ID: 15
Vulnerability Type: Auth issues
A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.