n this post, i would like to share a very simple logic flaw I found earlier this year I have found a way to circumvent mobile verification by utilizing a different portal for logging into a paypal account. The flaw lies inthe fact that paypal does not perform two step verification/authorization checks on all different portalsthat are used to log into a paypal account. Ideally, there should be a centralized authentication mechanism to authenticate the user or else additional authorization checks have to be applied to all different portals that are used to log into paypal ccount.In this case, We could use the mobile activation page tolog into the paypal account without happen to use a mobile phone.https://www.paypal.com/us/cgi-bin/?cmd=_mobile-activate-outside
No comments:
Post a Comment