Thread by @fs0c131y

Hi @KamalAditi,

Challenge accepted!

Please find below the first flaw of #Kimbho app 2.0 aka how to get the online status of #Bolo users

https://twitter.com/KamalAditi/status/1017787551850131456

First thing first, we are talking about this app "Bolo Messenger - Secure Chat, Voice & Video Calls" which is the new version of the #Kimbho app play.google.com/store/apps/det…

When you send a message with the #Bolo app, it is checking if your contact is online with this request. The endpoint is taking the "contact userId" (the 1st black rectangle in the picture)

If the request is successful, you will receive this response with 2 info:
- If the user is online
- Last active time

Let's try to have the status of someone which is not my contact!

In this other request, the app is putting your phone number in the "contacts" parameter. If the request is successful you will receive a response with your userId.

Magic time:
1) In the previous request, replace the "contacts" parameter by the phone number of someone which has a Bolo account
2) In the response, you will receive his userId
3) Use this userId in the 1st request I mentioned in the thread

Even if you don't have it on your contact list you will receive his online status and last active time. Not good for a so called "secure" chat app, nah? What do you think @KamalAditi?

Before challenging people like a kid, hire real professional to test your app before the launch. You have awesome and talented people available in India, hire them for god sake!

It took me 10 min to find that. I have more if needed. Try again.