Pageviews

Monday, 5 March 2018

Thankyou McDonald for free cookies

Hi Internet,

Summary:
Pwing McDonald's  in 3 step and getting access to 5000+ usernames and passwords of McDonald's users. Hope you like the read..
Img Src: https://www.creativebloq.com/logo-design/mcdonalds-logo-short-11135325

Abstract:

Well, finding this bug was not a pain it was simple, and if you are not aware www.mcdelivery.co.in is under bug bounty program.

Lets Get Started :
As usual i started with sub-domain enumeration where I got a  subdomain (email.mcdelivery.co.in) which was not hosting any services for customers. Moving further I ran dirsearch on same, and  got 200 OK @ (email.mcdelivery.co.in/dump.tar.gz) (Looks like some kind of backup for McDelivery).

FYI
Okay so, extracting the tar file made me concluded it's actual a backup of McDelivery which consists of many things such as their DB, Website Backup's and many other juicy information. (Still I feel there must me something more...)

Lets Do Some Old School Tricks :
Why not simply do keyword search in entire dump file using grep
Then come's the results, their were multiple files having match of keyword "password" but then there was an excel sheet as well which I couldn't find during my manual search (GUI based).
The excel file had ~ (tilde) symbol after extension, obviously askubuntu have an answer for this. Anyways, guess what the excel sheet had username, email ID and password's !!!
and the count goes on .....

Big deal huhh !

Quick Flash :
25th February 2018: Informed McDonald's
26th February 2018: McDonald's Acknowledged 
28th February 2018: Reminder sent to McDonald's
28th February 2018: McDonald's Escalated Internally
28th February 2018: Issue Resolved




Regards
Dhiraj

5 comments:

  1. where to report? They are taking a month to reply me

    ReplyDelete
    Replies
    1. Yea, they take time to reply, but surely they will :)

      Delete
  2. تعتبر شركة ركن الامانة (0505561372) للخدمات المنزلية من اهم الشركات التى تقدم لعملائنا الكرام المجالات و الارشادات بعمليات التنظيف المستمرة حيث تستخد الشركة افضل الاجهزة و المواد التنظيف الحديثة لنقوم بعمليات التنظيف و المكافحة حيث نقوم بازالة البقع بكل بساطة و بدون عناء فهدفنا هو ارضاء العميل فاتصلوا بنا على رقم الشركة
    شركة تنظيف خزانات بابها
    شركة تنظيف مجالس بابها
    شركة تنظيف بابها
    شركة تسليك مجارى بابها
    شركة كشف تسربات المياه بابها
    شركة مكافحة حشرات بابها
    شركة عزل اسطح بابها
    شركة عزل خزانات بابها
    شركة نقل اثاث بابها
    شركة تنظيف منازل بابها

    ReplyDelete