Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Partyhack 3.0 - Telegram bugbounty writeup

F26c65b4ad90e281e3d866f466783201?s=47 Bo0oM
April 12, 2019
0
3.7k

Partyhack 3.0 - Telegram bugbounty writeup

F26c65b4ad90e281e3d866f466783201?s=128

Bo0oM

April 12, 2019
Tweet

More Decks by Bo0oM

See All by Bo0oM
31337
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
15
Your back is white
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
72
FTP2RCE
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
4.2k
Interpret it!
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
830
At Home Among Strangers
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
1
2.8k
2000day in Safari
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
2
1.8k
Defcon Russia | Bo0om vs Шурыгина
F26c65b4ad90e281e3d866f466783201?s=48 bo0om
0
1.5k

Featured

See All Featured
Making Projects Easy
C4de88ea47538e4594750e3861a341c8?s=48 brettharned
98
4.3k
ReactJS: Keep Simple. Everything can be a component!
Af6a12710770ad9a7cfd08c97efd40d3?s=48 pedronauck
655
120k
Building Better People: How to give real-time feedback that sticks.
9952dfcd5d338f8a8e7175c8a8f65fb5?s=48 wjessup
344
17k
Pencils Down: Stop Designing & Start Developing
79acae287842acf29084005533a7fb3b?s=48 hursman
112
9.8k
Optimizing for Happiness
25c7c18223fb42a4c6ae1c8db6f50f9b?s=48 mojombo
365
63k
The Success of Rails: Ensuring Growth for the Next 100 Years
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
10
3.4k
How To Stay Up To Date on Web Technology
8081b26e05bb4354f7d65ffc34cbbd67?s=48 chriscoyier
780
250k
JavaScript: Past, Present, and Future - NDC Porto 2020
3ab1249be442027903e1180025340b3f?s=48 reverentgeek
37
3.3k
The Language of Interfaces
Fde6c3a50ca518a909ef35c22c0ee0e4?s=48 destraynor
148
20k
Automating Front-end Workflow
96270e4c3e5e9806cf7245475c00b275?s=48 addyosmani
1351
200k
The Invisible Customer
4262b9cfacfb6b2c77f23e1d0310cd3e?s=48 myddelton
110
11k
Raft: Consensus for Rubyists
B6a8f005f39d23ffc930508ac9da68b9?s=48 vanstee
126
5.4k

Transcript

  1. Вступление

  2. None
  3. None
  4. None

  5. КАК-ТО МНЕ НУЖНО БЫЛО ПРИДУМАТЬ ТЕМУ ДЛЯ ДОКЛАДА Как я

    телеграм ломал
  6. None
  7. None

  8. https://github.com/Bo0oM/fuzz.txt

  9. https://github.com/Bo0oM/server-status-monitor

  10. None
  11. None
  12. None

  13. https://github.com/telegramdesktop/tdesktop/blob/cc2c13d0182c62dd5a89784a49ec375306 449797/Telegram/SourceFiles/core/crash_report_window.cpp#L506

  14. None
  15. None
  16. None
  17. None
  18. None

  19. Database: tdesktopdbase Table: users [4 columns] +----------+ | Column |

    +----------+ | id | int(11) | | login | | logincrc | | pwdhash | +----------+ Database: tdesktopdbase Table: keyvalue [3 columns] +--------+ | Column | +--------+ | key | | value | | id | +--------+ Database: tdesktopdbase Table: crashes [6 columns] +----------+ | Column | +----------+ | date | | version | | dump | | id | int(11) | | platform | | viewed | +----------+
  20. None
  21. None
  22. None

  23. https://t.me/WebPwn https://twitter.com/i_bo0om