Hijacking eBay – Yasser Ali's Blog

Hijacking eBay users

How I could change your eBay password

Post author:eng_yasser
Post published:June 3, 2014
Post category:Security
Post comments:12 Comments

12 responses to “How I could change your eBay password”

P Bowie

September 22, 2014

Id love to be able to get into one gmail acct !! 🙂

Reply
evilReddy

September 23, 2014

nice bro..

Reply
Zoltan L. Nemeth

December 8, 2014

Hi Yasser,

Many thanks for your efforts to explain your discoveries, its a great help for the whole security community.

But, I think that in the figure the phrase

“Attacker intercepts the request, save the reqinput …”

is somewhat misleading, as the attacker do not need to catch the e-mail, as the figure might suggests, but he learns the reqinfo token earlier by browsing the page where he enters the victim’s e-mail address.

More precisely, the reqinput token is sent by the server in a hidden input field of the
/EnterUserInfo page.

I am sure you are aware of this, I just made this comment for the less experienced
readers like me.

Congrats for your success on Paypal, regards

Zoltan

Reply
1. yasser
  
  December 8, 2014
  
  Yes, We could do it that way too 🙂
  
  Reply
  1. Brooke
    
    May 14, 2015
    
    Yasser, I am having difficulties doing this.
    
    Can we please speak? I desperately need help with this!
    
    Reply
    1. yasser
      
      May 16, 2015
      
      Yes, because it has been patched 😉
      
      Reply
Ava

June 3, 2015

Yasser, Does this hack still work?

Please let me know Thanks!

Reply
1. yasser
  
  June 4, 2015
  
  Nope, This has been patched be eBay.
  
  Reply
Web Application Security & Bug Bounty

February 22, 2019

[…] How I could change your eBay passwordby Yaaser Ali […]

Reply
Guide 001 |Getting Started in Bug Bounty Hunting.. – Muhammad Khizer Javed

June 3, 2019

[…] How I could change your eBay password by Yaaser Ali […]

Reply
Bug Bounty Methodology (TTP- Tactics,Techniques and Procedures) V 2.0 ~ Cyberzombie

July 3, 2019

[…] How I could change your eBay password by Yaaser Ali […]

Reply
Getting Started in Bug Bounty Hunting | Complete Guide

August 30, 2019

[…] How I could change your eBay password Yaaser Ali […]

Reply