Re: [Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability

["Jon" <jbistogood@xxxxxxxxxxx>]

'https://register.passport.net/emailpwdreset.srf?lc=1033&em=vanecarolina13@h
otmail.com&id=&cb=&prefem=careverga7@.com&rst=1

And youâ?Tll get an email on attacker@xxxxxxxxxxxx'

Sure you didnt mean to replace one of the email addesses in there with
'attacker@xxxxxxxxxxxx'?
Even if you do, it doesn't seem to work. I tried switching each one for my
own and no such luck. I only recieved an email when both the addresses were
set to my hotmail account.
That means it's only any good if you have access to the users hotmail
account but don't know their password in the first place.

Jon


----- Original Message ----- 
From: "fernando escobar" <careverga7@xxxxxxxxxxx>
To: <full-disclosure@xxxxxxxxxxxxxxxx>
Sent: Tuesday, April 20, 2004 2:27 PM
Subject: [Full-Disclosure] Hotmail & Passport (.NET Accounts) Vulnerability


> I am forwarding this as it may impact people whom depend on MSN or
> passport systems for business reasons. Contrary to what at
> least one of the full-disclosure follow-ups reports, it does work.
>
> D
>
>
> ---------- Forwarded message ----------
> Date: Wed, 7 May 2003 19:50:51 -0700 (PDT)
> From: Muhammad Faisal Rauf Danka
> To: full-disclosure@xxxxxxxxxxxxxxxx
> Subject: [Full-Disclosure] Hotmail & Passport (.NET Accounts)
Vulnerability
>
> Hotmail & Passport (.NET Accounts) Vulnerability
>
> There is a very serious and stupid vulnerability or badcoding in Hotmail /
> Passportâ?Ts (.NET
> Accounts)
>
> I tried sending emails several times to Hotmail / Passport contact
> addresses, but always met
> with the NLP bots.
>
> I guess I donâ?Tt need to go in details of how cruical and important
Hotmail
> / Passportâ?Ts
> .NET Account passport is to anyone.
>
> You name it and they have it, E-Commerce, Credit Card processing, Personal
> Emails, Privacy Issues,
> Corporate Espionage, maybe stalkers and what not.
>
> It is so simple that it is funny.
>
> All you got to do is hit the following in your browser:
>
>
https://register.passport.net/emailpwdreset.srf?lc=1033&em=vanecarolina13@xxxxxxxxxxx&id=&cb=&prefem=careverga7@.com&rst=1
>
> And youâ?Tll get an email on attacker@xxxxxxxxxxxx asking you to click on
a
> url something like
> this:
>
>
http://register.passport.net/EmailPage.srf?EmailID=CD4DC30B34D9ABC6&URLNum=0&lc=1033
>
> >From that url, you can reset the password and I donâ?Tt think I need to
say
> >anything more about
> it.
>
> Vulnerability / Flaw discovered : 12th April 2003
> Vendor / Owner notified : Yes (as far as emailing them more than 10 times
is
> concerned)
>
>
> Regards
> --------
> Muhammad Faisal Rauf Danka
>
> _________________________________________________________________
> Charla con tus amigos en línea mediante MSN Messenger:
> http://messenger.latam.msn.com/
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html