HackenProof Disclosed Report

Main website

I got a bug called impersonation via broken link hijacking at official twitter account of HackenProof.

1. Go to the official HackenProof Website or Any Email sent from HackenProof
2. From the bottom of the page, click on the official Twitter Icon
3. Now click on the attached Telegram account
4. I have already hijacked the account

Impact:

The users who will want customer support through Telegram, will lose their accounts by sharing secrets with the attackers. Attackers can target the victims and tell them to get support through Telegram. As Attackers already hijacked the account, they may lead a lot of attacks against them.

Reference:

Link --> Broken Link Hijacking on Twitter link --> Severity: Medium --> $250 Bounty