Bigbasket Bug Bounty Writeup

Image for post
Image for post
Bigbasket Bug Bounty

Hello Everyone!

Image for post
Image for post
android:allowBackup=” true”
Image for post
Image for post
Device Connected
Image for post
Image for post
As you can see in the list of devices
Image for post
Image for post
ADB Backup Command
Image for post
Image for post
Image for post
Image for post
The above command skips the first block from the input file, which is the header part of our Android backup. (This one example file, not the real one, usually it will give some large amount of records here only 23 bytes)
Image for post
Image for post
Image for post
Image for post
Backup File
Image for post
Image for post
Client Secret Token
Image for post
Image for post
Apache Host Manager Access
Image for post
Image for post
Admin Panel
Image for post
Image for post
Hardcoded User Details and Token
Image for post
Image for post
Hall Of Fame + Bounty

Ethical Hacker | Security Engineer

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store