Shaadi.com hack ? How i am able to edit other people profile.

Recently from many facebook friends and some readers of Medianama has pinged me to know, how i am able to hack Shaadi.com accounts of other. It is very tough for me to reply to each and everyone, so this blog post.

Before I write few points

  1. I will explain in detail, how i am able to get full access of other people profle
  2. I have NOT HACKED, they have kept the site open by mistake. I am good guy :-), It is like I have not-unlocked the LOCKER, but they have kept LOCKER open.

What was the hack?

  • To edit your profile, i need your shaadi.com userlogin/email + password. But what if i can login as you, without your id and password?
  • I can see, To whom you have sent interest, Who all has sent interest to you, You accepted/rejected interest of which user.
  • I can change your shaadi.com profile. [Any part of shaadi.com profile]  [Text change will go into moderation to shaadi.com, rest all change will reflect instantly]
  • I can view your contact/mobile/land line number.
  • Simply, I am logged in as you, I can even send interest to other people 🙂  Or whatever i may wanted to do with your profile.
  • This hack was not applicable to all and any users, but only some users!  But as Shaadi.com  is out of top most 50 sites visited in India, that *Some users* count is also not small!

How to do the hack? [PS : Shaadi.com has fixed this, and after his CEO confirmed me on FB, I am disclosing how this was done]

  • Open Yahoo,google,bing and copy paste without quote in search box. “eml-trk site:shaadi.com”  [Use Yahoo/bing, as it will give you more results, means you can access more profile]
  • here is one simple link,
  • Now you click on any of the result,  you will get access to some users full profile! Yeah, you can edit/change/express interest with those user 🙂
  • You think this is Simple & Stupid? Even any 10th pass can get access of many many users in less than a minute time? Yes, you are right.

I Dont Believe

Do check Screenshot.

i can edit profile of shaadi.com user swati mittal

i can edit profile of shaadi.com user swati mittal. This is some random user, i dont know who she is!

shaadi hack

the same user has sent interest to what all user?

PS1 :  I have masked detail which is either private/personal or sensitive.  User’s name is anyway publicly available.

PS 2 : Anupam Mittal  [who is CEO People Group, has sent FB msg to me]

“thx for feedback. Issue is addressed. Was a bug that got introduced in the last dev cycle.”
PS 3:  I have not disclosed to anyone “How to get access of profile of shaadi.com” until Shaadi.com has fixed it. If you are beginner hackers like me, follow good practice who is willing to fix the bug.

 

PS4 [Read it carefully] : I have not edited/changed/sent interest etc with any profile of which i was having access. But…. reported immediately to Shaadi.com and Team @ Shaadi has fixed that quickly.   However  apart from me someone else might be in knowledge of bug and they might have done nasty stuff, So it is best for you to  cross check your profile/sent interest/recved  interest in detail, You only had sent interest to some person, or Some hacker has sent  interest to other on your behalf. Same way, someone has sent you interest or hacker has sent you interest as other person.

Advertisements

26 Comments

Filed under Uncategorized

26 responses to “Shaadi.com hack ? How i am able to edit other people profile.

  1. rajat

    Of particular interest is, how did the particular search keyword struck to you? 😛

  2. Pingback: Shaadi.com Security Vulnerability Allowed Access To User Profiles; Now Fixed - MediaNama

  3. raxitsheth

    it is art+science. i dont recall really how, but i was able to 🙂

  4. D Cyber Cop

    ahem ahem 😉

  5. paul

    i try copy and past ur given link eml-trk site:shaadi.com bt when i pest it on yahoo or bing show me this”http://search.yahoo.com/search?p=eml-trk+site%3Ashaadi.com&ei=UTF-8&fr=moz35″ now nothin can happen so can u please show me the way how can use it .. urgent so need ur help b

  6. ajay

    hi
    i try to many time but i can access that so please tell me what to thanks….reply me

  7. Ajay
    First Shaadi.com has fixed, after that we published.

  8. Can u help me to hack this bedside so I can use it free plz

  9. @Kuljeet, Sorry dude.

  10. I leave a response whenever I like a post on a blog or
    I have something to valuable to contribute to the conversation.
    It’s triggered by the sincerness communicated in the post I browsed. And on this post Shaadi.com hack ? How i am able to edit other people profile. | Raxitsheth doing TP :). I was actually excited enough to post a leave a responsea response 😉 I do have some questions for you if you usually do not mind. Could it be only me or do a few of these comments look like left by brain dead individuals? 😛 And, if you are posting on additional online sites, I’d
    like to follow anything new you have to post.
    Would you make a list all of your communal sites like your Facebook page, twitter feed,
    or linkedin profile?

  11. You actually make it seem really easy together with your presentation however I to find
    this topic to be really something that I feel I would never understand.
    It kind of feels too complicated and very huge for
    me. I am having a look ahead on your subsequent submit,
    I will try to get the cling of it!

  12. Јe peuҳ diire que ce n’еst pass incohérent …

  13. naveen pal sharma

    hi if u r interested then u can cal me at 8894167159

  14. Thank you for some other excellent post. The place else could anyone get that kind of info in such
    an ideal approach of writing? I’ve a presentation next week, and I’m at the look for such
    information.

  15. hey how do this , can you provide email list of user of shaadi.com .

    i have need email id of all register user .

  16. Јe remarգue de suitte que νous connaissez uperbement
    bien le sujet

  17. I want deactivate my account

  18. Superbe ρoszt encore une fois

  19. Splendide articlе ρour ne rien changer

  20. bap

    I got the response from someone but I am not a premium customer. I need only that persons details. how could I get?pls help me to solve this problem.

  21. Plz send my e-mail address to.th I profile.sh637721726.

  22. Clash clans hack clans clans hack generator, Conflict of clans hack
    cheats free gems the reality – youtube, Читы для clash of clans.

  23. How can I chat and. Send email I’d for other users

  24. swati

    how can i see other phone no.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s