[Dev]

Hello BreachForums Community,
Today I have uploaded the QuestApp.in Database for you to download, thanks for reading and enjoy!

https://cdn.bf.st/logo/questapp.png

In April 2024, the Indian digital learning platform Quest App (https://questapp.in/) was hacked by @DevEye, which then published this data on BreachForums. The leak includes over 694k users, contains 522k unique email addresses, dates of birth, genders, marital statuses, names, phone numbers and passwords stored as MD5 and bcrypt hashes.

Compromised data: Dates of birth, Email addresses, Genders, Marital statuses, Names, Passwords, Phone numbers, Website activity

Contents Spoiler

The .7z File's MD5 Hash is 5B67B14131D84B34B6BF342022209BD6. In total, there are 694865 records. The file is 941.87MB uncompressed and 941.92MB compressed.

Hidden Content

You must register or login to view this content.

Database Index <> How To Get Credits

[Addka72424]

@DevEye is there any way you can verify the authenticity of the data in the leak?It just looks like the password recovery form accepts any data, even that is not in the leak, and it is still possible to register using emails from the leak.

[Dev]

@DevEye is there any way you can verify the authenticity of the data in the leak?It just looks like the password recovery form accepts any data, even that is not in the leak, and it is still possible to register using emails from the leak.

Seems I messed up, it was infact the wrong website. That is rather embarrassing, at least you checked me, I looked into it further and have updated the thread. (How can someone make such a mistake? The only domain I had was a aws domain, with little context other than a few other things like mention to questapp.in , skillconnect, ksdc.itrackglobal.com, and it seems I didn't verify it properly enough to figure out where the data actually came from)

Quest App, https://questapp.in/ is it. We can verify this on the registration page, https://questapp.in/lms/register/account...ls/learner
Tested a few of the emails from the users table will show as "The email has already been taken" whereas any email not in the users.sql will show as available. - with exception, it seems a handful of emails say they're unregistered.

proofs Spoiler

POST
https://questapp.in/user-service/public/api/v1/user/validate
{"date_of_birth":"2002-02-05","email":"[email protected]","gender":"female","name":"Test"}

RESPONSE:
{"message":"The given data was invalid.","errors":{"email":["The email has already been taken"]}}

Non registered email:
{"date_of_birth":"2002-02-05","email":"[email protected]","gender":"female","name":"Test"}
Response: {"status":1,"message":"Success"}

Made a script to automate the checking process, see how many emails are labeled as registered and how many unregistered. Will check for a while and post results, so far 511 registered 9 not.

[Dev]

This got leaked few days back.. i was searching it from that day today i finally found it

Where at, if I may ask. Not surprising by any means. I believe it's at least not been posted on this forum

[Addka72424]

@DevEye is there any way you can verify the authenticity of the data in the leak?It just looks like the password recovery form accepts any data, even that is not in the leak, and it is still possible to register using emails from the leak.

Seems I messed up, it was infact the wrong website. That is rather embarrassing, at least you checked me, I looked into it further and have updated the thread. (How can someone make such a mistake? The only domain I had was a aws domain, with little context other than a few other things like mention to questapp.in , skillconnect, ksdc.itrackglobal.com, and it seems I didn't verify it properly enough to figure out where the data actually came from)

Quest App, https://questapp.in/ is it. We can verify this on the registration page, https://questapp.in/lms/register/account...ls/learner
Tested a few of the emails from the users table will show as "The email has already been taken" whereas any email not in the users.sql will show as available. - with exception, it seems a handful of emails say they're unregistered.

proofs Spoiler

POST
https://questapp.in/user-service/public/api/v1/user/validate
{"date_of_birth":"2002-02-05","email":"[email protected]","gender":"female","name":"Test"}

RESPONSE:
{"message":"The given data was invalid.","errors":{"email":["The email has already been taken"]}}

Non registered email:
{"date_of_birth":"2002-02-05","email":"[email protected]","gender":"female","name":"Test"}
Response: {"status":1,"message":"Success"}

Made a script to automate the checking process, see how many emails are labeled as registered and how many unregistered. Will check for a while and post results, so far 511 registered 9 not.

Thanks.Now the authenticity of the leak has been confirmed.Wait until it to be included in the official section.

[Dev]

Thanks.Now the authenticity of the leak has been confirmed.Wait until it to be included in the official section.

Thanks, I'm not going to be able to check all of them but:

Out of 3,489 emails checked ,

Registered: 3419
Unregistered: 70

[Specter404]

Thanks For thee post

[spongypickle]

yall think panda buy toasted or we chilling shits gonna be gone i thiink

[skunal007]

Anyone who has unlocked it, can you please share as i am short on credit and it will be of great help.

Thanks

[Dev]

Anyone who has unlocked it, can you please share as i am short on credit and it will be of great help.

Thanks

https://img001.prntscr.com/file/img001/9...hSyhoA.png