An Unexpected Account Takeover

Basavaraj Banakar
3 min readJul 3, 2021

Hii Everyone, Hope everyone doing well.

Myself Basavaraj, I am back again with My 3rd writeup, May be from this writeup you will learn something new or never neglect to check everything on a target.

Lets Start,

I thought to hack on a public program i.e old(around 3000+ bugs reported) lets take it as don’t have permission for disclosure), Its large scope program, As everyone starts with subdomain enumeration and filtering live subdomains, I also did the same and started looking manually each subdomain, tested around 25–30 subdomains got nothing, and finally I came across an subdomain with some functions. Now navigated that its gives an login page and also consist of signup page, Tested both signup, login, password reset But didn’t got anything. Now what, Lets move forward after logging in it redirect me to


Now I started looking each endpoint and does not came across any functional part to test vulnerabilities and I started to fuzz target But they blocked my VPS IP😔. Now I started looking source code to check hidden endpoint, This time also failed and Now started looking JS Files manually there are around 5–6 JS files started looking each one and I found that one JS file that’s size is 13MB after opening that endpoint file my chrome browser got freezed 😂. And after sometime it responded and started looking JS file after scrolling 1 hour I thought to close it and take another target, But at that time I came across some endpoints. started checking all endpoints one endpoint have some function i.e

JS file

After navigating I got somethings I don’t know what they do.


I Hope your thinking is right i.e rename parameter and I clicked rename and added xss payload there

XSS Payload

and clicked on rename and successfully got popup and also its stored xss

Stored xss

Now, I want to increase impact and quickly made another account and navigated to the , And Guess what I got popup there also🥳, Now I added Blind xss payload from xsshunter and added in rename field again with first account

Steal cookies

And now I logined to my second account and navigated to and checked my xsshunter And I got cookies of second account🥳..


Using these cookies I tried logging in and successfully logged in to the account.

Takeaway:- Never Ignore JS Files(Because I am about to leave checking of JS file)

Follow me on twitter :

Follow me on Instagram :

Website :