Recently in the wake of Pakistani hacker hacking india website (see here) I have decided to do my own security analysis on india websites. But before that I wanted to do some warm up with more commercial websites of India.
I am possibly one of the most hacky developers. However, recently I have realised that I am not bad when I started navigating various indian websites. In series of blog I will be showcasing few exploits that are fun and will provide links to essential tools I have developed.
My first target was Mumbai Mirror
Mumbai mirror is possibly one of most popular websites in Mumbai. It is a local news website. One of the key widgets/apps is the website is the Polling app. In the polling app, for a given question you can submit a vote. Apparently if you have already voted you are not allowed to vote again. However, in tutorial we will see how we can exploit this app and manipulate the polling of the website.
We used the same setup for Time of India with minimum changes.
I am possibly one of the most hacky developers. However, recently I have realised that I am not bad when I started navigating various indian websites. In series of blog I will be showcasing few exploits that are fun and will provide links to essential tools I have developed.
My first target was Mumbai Mirror
Mumbai mirror is possibly one of most popular websites in Mumbai. It is a local news website. One of the key widgets/apps is the website is the Polling app. In the polling app, for a given question you can submit a vote. Apparently if you have already voted you are not allowed to vote again. However, in tutorial we will see how we can exploit this app and manipulate the polling of the website.
Setup
All you need is basic understanding of html and javascript. Every polling question has an ID and there 3 possible option - Yes, No and Cannot say. The options are internally marked as 3,2 and 0 respectively. Also there is a captcha sort of math question that you have to solve before you submit your form. It is quite stupid in design as this math question is generated and checked at client-side and never passed to the server implying that this value is useless. All you have to do is find the webpage or service which update the poll data and POST these values. If you simply go through the source code, you will discover that the required webpage is "/vote.cms". The Java API link there is basically and http client wrapper that POST PollId and Option to the vote app. In short, we loop on while true and keep POSTing those values.We used the same setup for Time of India with minimum changes.
Experiment
The poll looks as follows
Within 10 minute of experiment the Can't say moved from 6% to 52%
In a difference of 6 minutes we achieved 6% growth in Can't say
And finally achieving this :P
I ran my tool on another question and achieved 100% No.
One could also see that Time of India and Mumbai Mirror uses same web framework so I unleashed my POST request on TOI polls too and it worked. This makes me wonder that a big internet company like Indiatimes.com has such a shoddy development. While I was analyzing the site, I found more serious loopholes which cannot be published and isn't a good news for end user.
I am going to open source the project soon.
In next blog you will see how I am going to hack cbse website.
