# Get Bounty 💵 with Account takeover (ATO) | vulnerability is still not patched yet HURRY!

**URL:** <https://onehack.st/t/get-bounty-with-account-takeover-ato-vulnerability-is-still-not-patched-yet-hurry/73108>\
**Category:** Money Making Methods & Guides\
**Tags:** tools, hacking, earn-money\
**Created:** [March 12, 2020, 3:03am UTC](https://onehack.st/t/get-bounty-with-account-takeover-ato-vulnerability-is-still-not-patched-yet-hurry/73108 "2020-03-12T03:03:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shayla](https://onehack.st/user_avatar/onehack.st/shayla/32/174870_2.png) [@Shayla](https://onehack.st/u/Shayla)\
**Post date:** [March 12, 2020, 3:03am UTC](https://onehack.st/t/get-bounty-with-account-takeover-ato-vulnerability-is-still-not-patched-yet-hurry/73108/1 "2020-03-12T03:03:11Z")

</div>

# Got _Bounty_ with Account takeover (ATO ) Unicode-Case Mapping Collision !

 ![image](https://onehack.st/uploads/default/original/3X/7/5/75d6908a9a84942902565fd34093c4866984a562.png)

## Hey hunters ! Recently I discovered a Unicode-Case Mapping Collision vulnerability on a private program.

_**Unicode exceptionally complex. Few people know all the tricks: from invisible characters and control characters to surrogate pairs and combined emojis (when adding two characters you get a third).**_

> As the vulnerability is still not patched yet so I’m denoting the website with “xyz.in” in this blog

 ![image](https://onehack.st/uploads/default/original/3X/7/a/7ac3257a994341cf7e6d2c9c02518db71d2cd96d.jpeg)

> I have just registered my own domain to exploit a security flaw in xyz.in forgot password process to gain access to an account that belongs to a privileged user.

# THAT SHIT COST ME $20 😂

## In this case, I used the Turkish character ‘ı’ (‘i’ without a dot), which is translated into Latin ‘i’, so that the postal address `Test@xyz.` ı `n ` after processing turns into Test@xyz.in

- Successfully created a domain xyz. ın (Without the dot)
- Created Free email from Google G-Suite trial pack and named it “Admin@xyz. ın”
- Created an account on “xyz.in” with the malicious email address as “admin@xyz.ın”
- Logged out from that account \>\> logged in “admin@xyz.ın” and clicked on Forget Password.
- Intercepted the request\>\> And the input reflecting in UPPER CASE
- The DB found replaced the malicious user with the correct one and triggered a password reset token on the malicious email address.
- Successfully changed the password of the admin user, and got the bounty!!

## Such collisions can be found on all Unicode planes:[here is the complete list .](https://eng.getwisdom.io/awesome-unicode/#onetomanycasemappings)

 ![image](https://onehack.st/uploads/default/original/3X/2/b/2b5fcde53d9b36c809f83c6bb29ba62314bd338a.jpeg)

Happy Hunting! 💰

`Credits: @shaurya_sharma`

---

<div class="post-metadata">

**Author:** ![peekacho](https://onehack.st/user_avatar/onehack.st/peekacho/32/18344_2.png) [@peekacho](https://onehack.st/u/peekacho)\
**Post date:** [March 12, 2020, 8:10am UTC](https://onehack.st/t/get-bounty-with-account-takeover-ato-vulnerability-is-still-not-patched-yet-hurry/73108/2 "2020-03-12T08:10:09Z")

</div>

**The question is** , How and where did he registered the domain with a Latin words ?