How I Hacked A Telecom Company

i called them to report it when i saw the IDOR, i showed them all the screenshots and i even demonstrated to them, like gave them a live demo.

they had me with 3 other people who want me to explain what i did.

and i said i could bypass the login too ( havent tried yet )

the guy was shocked and said you cant. no one can.

i dont know why i said " bet, give me 5 minutes "

i almost regretted that, i didnt know i can even bypass it, i almost gave up but i tried and tried. and guess what…

IT WORKED!!!

a successful bypass!!

they fixed them, but in 30 minutes i managed to do it again.

they added an authtoken header, if i delete the value its like nothing was fixed. and after that i kept getting ignored.

( i mostly do these pentests for free btw )

i hope you guys enjoy.

so it all started with a text.

i thought it was a scam so i ignored it, until i was actually billed

i decided to take a look at their website ( my telecom account ).

i kept burpsuite running and browsed like normal.

what i found shocked me, they have no server side validation.

at first i made a normal legit login to see the response, then i tried logging in but with a random otp

it got rejected, then i did the same one but i changed the response like the legit login

and it logged me in. by just changing the response values. password or oto still the same steps.

and yes it can let me see any numbers SMS messages

then i tried viewing my profile with my phone number.

my number is on the top left of the request.

i changed it to a different number, it should give me a 403 or a 401 right?

wrong. it gave me access to their PII

ID number , phone numbers tied to their original phone number , access to their account, contract numbers , full names and emails, pin codes , puk codes etc.

thats not all, it even gave me their home address

with that, i could get the entire subscribers and their personal information.

i did that for free and kept getting ignored. :)

the important thing is, report and forget.

impact?

• full account take over
• impersonation
• sim swapping
• so much bad things

dont forget

thank you for reading

see you in the next one.