Two-factor authentication bypass on Grab Android App
该报告还没有中文解读。
原文摘录
摘自原文（3143 字符中的一小部分）
Description I found the endpoint using android app `https://p.grabtaxi.com/api/passenger/v2/profiles/edit` which allow me to bypass 2FA (sms code) due to lack of rate limiting\code expiration after unsuccessful attempts. The root cause of the problem it that facts: no rate limiting+ no code …
原文中的代码
PUT /api/passenger/v2/profiles/edit HTTP/1.1 Content-Type: application/x-www-form-urlencoded x-mts-ssid: [current session id, its too long so i removed it for report space economy] x-request-id: 3b609418-0e40-4f86-8ff6-4f23dfac420f Host: p.grabtaxi.com Content-Length: 26 Accept-Encoding: gzip …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Grab 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @sp1d3rs · 版权归作者与 Grab 所有