[FREE] [telegram exploit] find any user's hidden phone number

[55]

source:https://github.com/graysuit/CVE-2019-15514

CVE-2019-15514
Type: Information Disclosure
Affected Users: All Telegram Users
Still not fixed/unpatched. brute.py is available exploit written under python.

Description:
Suppose ali is hacktivist. His telegram user ID is 21788973 and mobile number is hidden. He lives in pakistan (+92). We can add any user to contact by phone number. We will add phones numbers from range +92-0000000000 to +92-9999999999. So if any number successfully added and that user ID is 21788973, that's mean ali number is successfully exposed !

Note: All above information supplied is hypothetical.

Remember, current example range was 9 digits long. We can reduce it more by social engineering, sim code knowledge, password resets (specially gmail,paypal)... The more low range, the more less time will it take.

Background:
This bug been exploited in wild from long. This appreciated us to investigate and open source its exploit for making telegram to patch it soon.

Proof Of Concept
Suppose, we have an telegram victim that number starts with 92313, ends with 89 and in between there are 5 unknown digits We will generate all combinations of number list within range 92313-xxxxx-89.

Use num_gen.py. It will write numbers to 92313xxxxx89.txt. Before, must edit following:

• prefix: a number should starts with. Here example, its 92313
  
• middle_range: total digits of unknown middle range. Here example, its 5
  
• suffix: a number should ends with. Here example, its 89
  

Brute force:

• *phone: insert your phone number including country code, without including spaces or +(plus)
  
• *api_id: create app and insert api id. learn more
  
• *api_hash: create app and api hash. learn more
  
• *numlist : the path to your numbers list or wordlist
  
• *username_or_id: insert numeric id or username without @ of victim. Better use kotatogram as it supports showing user id in profile.
  
• use_proxy: Enable or Disable proxy
  
• proxy_server: domain or ip of proxy DNS
  
• proxy_secret: hex encoded secret of proxy that serves as password
  
• proxy_port: numeric port, mostly 443
  
• should_resume: resume capability. whether to start from where numbers left ?
  
• threads: # numbers to be tried on each try, don't increase else won't work
  
• delay: delay in seconds on each try to lower telegram block time interval
  

Features:

1. multi-threaded i.e checks 19 numbers at time
   
2. resume capability
   
3. waits when blocked, time it waits equals to time telegram blocks
   
4. accurate results
   

Credits:

• Telethon for providing easy library,Telethon community for help about api usage
  
• swagkarna for inspiration
  

I Love ALLAH + Holy Prophet + Islam and Pakistan.

I'm Masoom Shetaan (innocent evil). Both are opposites. It just depend upon challenge I have been assigned.

[55]

This is a bump

I'm Masoom Shetaan (innocent evil). Both are opposites. It just depend upon challenge I have been assigned.

[55]

This is a bump

I'm Masoom Shetaan (innocent evil). Both are opposites. It just depend upon challenge I have been assigned.

[57]

thank man

[303]

ill check

[39]

hih[

---

hhpo0

[12]

how i get user id of the user
 

source:https://github.com/graysuit/CVE-2019-15514

CVE-2019-15514
Type: Information Disclosure
Affected Users: All Telegram Users
Still not fixed/unpatched. brute.py is available exploit written under python.

Description:
Suppose ali is hacktivist. His telegram user ID is 21788973 and mobile number is hidden. He lives in pakistan (+92). We can add any user to contact by phone number. We will add phones numbers from range +92-0000000000 to +92-9999999999. So if any number successfully added and that user ID is 21788973, that's mean ali number is successfully exposed !

Note: All above information supplied is hypothetical.

Remember, current example range was 9 digits long. We can reduce it more by social engineering, sim code knowledge, password resets (specially gmail,paypal)... The more low range, the more less time will it take.

Background:
This bug been exploited in wild from long. This appreciated us to investigate and open source its exploit for making telegram to patch it soon.

Proof Of Concept
Suppose, we have an telegram victim that number starts with 92313, ends with 89 and in between there are 5 unknown digits We will generate all combinations of number list within range 92313-xxxxx-89.

Use num_gen.py. It will write numbers to 92313xxxxx89.txt. Before, must edit following:

• prefix: a number should starts with. Here example, its 92313
  
• middle_range: total digits of unknown middle range. Here example, its 5
  
• suffix: a number should ends with. Here example, its 89
  

Brute force:

• *phone: insert your phone number including country code, without including spaces or +(plus)
  
• *api_id: create app and insert api id. learn more
  
• *api_hash: create app and api hash. learn more
  
• *numlist : the path to your numbers list or wordlist
  
• *username_or_id: insert numeric id or username without @ of victim. Better use kotatogram as it supports showing user id in profile.
  
• use_proxy: Enable or Disable proxy
  
• proxy_server: domain or ip of proxy DNS
  
• proxy_secret: hex encoded secret of proxy that serves as password
  
• proxy_port: numeric port, mostly 443
  
• should_resume: resume capability. whether to start from where numbers left ?
  
• threads: # numbers to be tried on each try, don't increase else won't work
  
• delay: delay in seconds on each try to lower telegram block time interval
  

Features:

1. multi-threaded i.e checks 19 numbers at time
   
2. resume capability
   
3. waits when blocked, time it waits equals to time telegram blocks
   
4. accurate results
   

Credits:

• Telethon for providing easy library,Telethon community for help about api usage
  
• swagkarna for inspiration
  

I Love ALLAH + Holy Prophet + Islam and Pakistan.