Jump to content

How to: PHP Based Exploits (iOS applications)


10 posts in this topic

Recommended Posts

Updated (edited)
 
                Hello, user!
 
Today I'm going to show you how I through this script together and how exactly I found it :)! (url with the exploit for the followers will be up soon, (school project final :p)
 
Before we start off we must know what exactly this 'bot' does, and what it does is add the respected
followers or likes to the share url or the username provided.
If you are wanting to replicate this, or even replicate finding vulnerabilities you must understand that we aren't looking at the Instagram app at all, and instead we are targeting third party applications such as 'FollowGram' or 'InstaFamous' these applications provide the opportunity to use an in-game currency such as tokens or coins to redeem followers or likes.
 
Now we need a way to attempt to manipulate the data to increase our coins or tokens, we can first try using our local storage (File manager) on our iOS or Android device, once you have that downloaded you can go ahead and locate the application and you can try to attempt to modify the data, but in most cases this doesn't work for various reasons such as when the application is loaded it checks your local application storage files and compares them to the server and if they are in the slightest different they will reset to the default value (usually this is the first test I do).
 
Next is to MITM the application to try and find any PHP based exploits (which is the fun part) in order to intercept your application you will need to download a tool (Burp Suite is my personal favorite but there are many tools you can use, Charles and MITM-Proxy are a couple others.
There are many tutorials online on how to configure this with your device. Once that is setup comes the testing and you have to be patient for this as every application doesn't work. (tutorial with vuln. application coming soon)
 
But let's say you are trying to exploit your favorite application for Instagram followers. Once you have downloaded the application sign into your Instagram account and start intercepting the application, and here comes the part you need to pay attention to, when you have your application up and running you are going to want to do something in the application to get coins/tokens such as following someone or watching a video for 1 free coin, spending your coins, etc. If you have interception on correctly you will see JSON come up on your screen and this WILL vary for every application
 
EXAMPLE OF JSON: 
{'user'='instagramuser123','follow'='TRUE','coins'='1'}
or in some cases
user=instagramuser123&follow=TRUE&coins=1

great it's in plain text JSON :)! From here you can send this item to the repeater and just repeat this process which makes the server think you are following more people but in reality you are not :) and this will then increase your balance on the application.

 

If you wanted to change the 'coins'='1' to 'coins'='100' you could try that aswell and see how it goes! Congrats! You found an exploit! But what if this doesn't work? What can I do? Well you can try spending your coins (which I have found effective)

 

Lets say the JSON resembles this when you purchase followers 

{'action'='spendPoints','coins'='500'} 

or 

action=spendPoints&coins=500

well you know how these apps have "if you unfollow a user you will get 5 coins back" or whatever if we change the 'coins'='-500' we are basically saying 500 people unfollowed us so give me my coins back, and so it does :).

These are just a few of many tricks I have found while trying to find vulnerabilities within applications :)! another thing I should have said is you are going to want to keep an eye out for POST requests instead of GET as I basically tell my self POST is for POSTing things to the server instead of GETting them.

Most if not all exploits will be with a POST request

 

If you have any questions let me know and I will try to help as much as I can ;) I wont be giving out my personal exploits/scripts but I will be more than happy to help you make/find some :) Enjoy!

Updated by niro
  • Like 1
Posted

Hey! 

 

I'm familiar with this kind of stuff... but, what repeater? How do you send the modified data back to the server? :D


Awesome tutorial!

Posted
  On 6/3/2016 at 7:52 PM, Zimon said:

Hey! 

 

I'm familiar with this kind of stuff... but, what repeater? How do you send the modified data back to the server? :D

Awesome tutorial!

repeater is an option within burp suite (should have mentioned that)

but the repeater can repeat certain tasks (like a POST or a GET) without you having to physically do it over again

lets say you search google on your phone and then you send it to the repeater you can keep repeating just that request from within burp so you dont have to do it on your phone :)

Posted

ok ! thx niro ~   

 

can you hack any good followers app ! and share it here ? 

 

like fastfollowers ! 5000 followers !

 

 

i hope u do ! 

Posted (edited)

this is fresh dawg! how exactly do i repeat it within repeater though?

 

also would it work if i could get on the app on my computer instead of my device?

like for some of those apps, i can log in via computer, would that work with burp?

let me know dawg, thanks soooo much for this tut! you're the bombdiggity.

 

also im an experienced programmer/coder and have created a few apps.

i was wondering if its somehow possible to repeat the actions in python 2.7 or 3.0

to make the actions faster? let me know dawg.  :)

Updated by Multitask

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Dawn of Ages: Medieval Games v2.0.7 +5 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
      Bundle ID: com.stratospheregames.dawnofages
      App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Dumb Enemy
      - Premium Enabled
      • 7 replies
    • Disney Speedstorm v1.13.0 +1 Jailed Cheat [ Unlimited Nitro ]
      Modded/Hacked App: Disney Speedstorm By Gameloft
      Bundle ID: com.gameloft.disneyspeedstorm
      iTunes Store Link: https://apps.apple.com/us/app/disney-speedstorm/id6449708682?uo=4


      Hack Features:
      - Unlimited Nitro -> Will not decrease.
      - Instant Nitro Max


      Jailbreak required hack(s): [Mod Menu Hack] Disney Speedstorm v1.5.0 +2 Cheats [ Unlimited Nitro ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 84 replies
    • Disney Speedstorm v1.13.0 +1 Cheat [ Unlimited Nitro ]
      Modded/Hacked App: Disney Speedstorm By Gameloft
      Bundle ID: com.gameloft.disneyspeedstorm
      iTunes Store Link: https://apps.apple.com/us/app/disney-speedstorm/id6449708682?uo=4


      Hack Features:
      - Unlimited Nitro -> Will not decrease.
      - Instant Nitro Max


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Disney Speedstorm v1.5.0 +2 Jailed Cheats [ Unlimited Nitro ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 78 replies
    • Dawn of Ages: Medieval Games v2.0.7 +5 Cheats [ Damage & Defence ]
      Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
      Bundle ID: com.stratospheregames.dawnofages
      App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Dumb Enemy
      - Premium Enabled

       

      ⬇️ iOS Hack Download Link


      Hidden Content

      Download Hack







       

      📖 iOS Installation Instructions

      STEP 1: Download the .deb hack file from the link above. Use Safari, Google Chrome or other iOS browsers to download.
      STEP 2: Once the file has downloaded, tap on it and then you will be prompted on whether you want to open the deb with iGameGod or copy it to Filza.
      STEP 3: If needed, tap on the downloaded file again, then select ‘Normal Install’ from the options on your screen.
      STEP 4: Let iGameGod/Filza finish the cheat installation. If it doesn’t install successfully, see the note below.
      STEP 5: Open the game, log in to your iOSGods account when asked, then toggle on the features you want and enjoy!

       

      NOTE: If you have any questions or problems, read our Jailbreak iOS Hack Troubleshooting & Frequently Asked Questions & Answers topic. If you still haven't found a solution, post your issue below and we'll do our best to help! If the hack does work for you, please post your feedback below and help out other fellow members that are encountering issues.

       

      🙌 Credits

      - @Puddin
      - @Laxus

       

      📷 Cheat Video/Screenshots

      N/A

       

      More iOS App Hacks
      If you’re looking for Non-Jailbroken & No Jailbreak required iOS IPA hacks, visit the iOS Game Cheats & Hacks or the iOSGods App for a variety of modded games and apps for non-jailbroken iOS devices.

      Modded Android APKs
      Need modded apps or games for Android? Check out the latest custom APK mods, cheats & more in our Android Section.
      • 14 replies
    • Earth Inc. Tycoon Idle Miner v5.3.0 +3 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Earth Inc. Tycoon Idle Miner By Treetop Crew Oy
      Bundle ID: com.TreetopCrew.EarthInc
      iTunes Store Link: https://apps.apple.com/us/app/earth-inc-tycoon-idle-miner/id1582514877?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Jailbreak required hack(s): [Mod Menu Hack] Earth Inc. v2.2.1 +3 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 81 replies
    • Earth Inc. Tycoon Idle Miner v5.3.0 +3 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Earth Inc. Tycoon Idle Miner By Treetop Crew Oy
      Bundle ID: com.TreetopCrew.EarthInc
      iTunes Store Link: https://apps.apple.com/us/app/earth-inc-tycoon-idle-miner/id1582514877?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Unlimited Coins -> Will increase instead of decrease.
      - Unlimited Diamonds -> Will increase instead of decrease.
      - Free In-App Purchases


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Earth Inc. v2.2.1 +3 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 49 replies
    • Slots Era - Slot Machines 777 v2.57.0 +100++ Jailed Cheats [ ULTIMATE HACK ]
      Modded/Hacked App: Slots Era - Slot Machines 777 By Murka Games Limited
      Bundle ID: com.murka.slotsera
      iTunes Store Link: https://apps.apple.com/us/app/slots-era-slot-machines-777/id1133138987
       

      Hack Features:
      - Debug Menu -> Head over to Settings and toggle the Privacy Policy button.


      Jailbreak required hack(s): https://iosgods.com/topic/172023-slots-era-slot-machines-777-v2200-100-cheat-srdebugger/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 177 replies
    • Slots Era - Slot Machines 777 v2.57.0 +100++ Cheats [ ULTIMATE HACK ]
      Modded/Hacked App: Slots Era - Slot Machines 777 By Murka Games Limited
      Bundle ID: com.murka.slotsera
      iTunes Store Link: https://apps.apple.com/us/app/slots-era-slot-machines-777/id1133138987
       

      Hack Features:
      - Debug Menu -> Head over to Settings and toggle the Privacy Policy button.


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 281 replies
    • Glow Fashion Idol v0.6.3 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Glow Fashion Idol By CRAZY LABS BY TABTALE , G.P.
      Bundle ID: com.crazylabs.fashionsquad
      iTunes Store Link: https://apps.apple.com/us/app/glow-fashion-idol/id6446197181?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems


      Jailbreak required hack(s): [Mod Menu Hack] Glow Fashion Idol v0.3.3 +2 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 57 replies
    • Glow Fashion Idol v0.6.3 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Glow Fashion Idol By CRAZY LABS BY TABTALE , G.P.
      Bundle ID: com.crazylabs.fashionsquad
      iTunes Store Link: https://apps.apple.com/us/app/glow-fashion-idol/id6446197181?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Glow Fashion Idol v0.3.3 +2 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 29 replies
    • Good Pizza, Great Pizza v5.32.0 +8 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds
      - Unlimited Pizza Pass Claim -> Only works if you haven't claimed that reward yet.

      VIP
      - Unlimited Pizza Pass Tokens
      - Chef Pass Unlocked
      - Max Pizza Pass Level
      - Starter Bundle Unlocked
      - All Achievements Completed
      • 352 replies
    • Good Pizza, Great Pizza v5.32.0 +8 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds
      - Unlimited Pizza Pass Claim -> Only works if you haven't claimed that reward yet. 

      VIP
      - Unlimited Pizza Pass Tokens 
      - Chef Pass Unlocked 
      - Max Pizza Pass Level 
      - Starter Bundle Unlocked 
      - All Achievements Completed
      • 184 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines