D4Vinci / Cr3dOv3r

Know the dangers of credential reuse attacks.
MIT License
2k stars 413 forks source link

Instagram login is a false positive #33

Closed MansoorMajeed closed 6 years ago

MansoorMajeed commented 6 years ago

On a wrong password, the script says the instagram password is successful.

#Now let's check if it was success by trying to use the same form again and if I could use it then the login not success
    try:
        browser.select_form(form2)
        browser.close()
        return "{2} -[{1}{3} {0} {4}{2}] Login unsuccessful!{4}".format(name,R,W,Bold,end)
    except:
        browser.close()
        return "{2} -[{1}{3} {0} {4}{2}] Login successful !{4}".format(name,G,W,Bold,end)

I think this is the part where the issue is.

upgoingstar commented 6 years ago

Same goes for Linkedin. That's also a false positive. If I get some time this weekend, I will try to send a pull request.

h3ct0rjs commented 6 years ago

Confirmed @MansoorMajeed Instagram is a false positive, the if you don't enter a password it will mark instagram as sucessful

D4Vinci commented 6 years ago

Started to work on the new update, wait for it very soon

h3ct0rjs commented 6 years ago

cool, please send us a message to be beta testers.

D4Vinci commented 6 years ago

Instagram removed and version 0.3 released check it out and please reopen the issue if their's still an issue

h3ct0rjs commented 6 years ago

Hi @D4Vinci can you reference the commit that solves the problem, it seems that you're trying to get the len size of a data type bool.

Check this Core/ispwned.py", line 41

Final_text = "\n(GG)Results from haveibeenpwned website (W): (Y)"+str(len(data))

D4Vinci commented 6 years ago

This variable should not be bool this error may appear because haveibeenpwned blocked you after many tries with their rate limiting Maybe I will make haveibeenpwned runs from command line argument to avoid block after 3-4 uses :3

D4Vinci commented 6 years ago

Released a hotfix now check it out and please respond if there's any problem remaining

h3ct0rjs commented 6 years ago

Hi @D4Vinci please try to reference the hotfix with the commit id, is more helpful to find the changes that you did.

It seems okay to me, but in the last version it didn't try to make a test against instagram.

Regards, Hector F.