# Получение вечного доступа к Long Pool и авторизованой страницы сайта, если мы когда-либо были на аккаунте жертвы

VK 'Молодец' bot leaked Long Poll credentials to a script; once stolen, attacker kept reading victim's private messages forever, surviving password resets.

- Payout: $500
- Severity: high
- Program: VK.com
- Credited: povargek
- Disclosed: 2018-10-07
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/337734
- Library page: https://bugbountylibrary.com/r/h1%3A337734
- Tags: domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** VK Long Poll API / 'Молодец' bot
**Root cause:** The 'Молодец' bot performed insufficient authentication checks, exposing Long Poll credentials (key/ts/server) that remained valid indefinitely and were not revoked on password change or session termination.
**Steps:**
1. Obtain victim account access once (any means) and capture the Long Poll credentials (key, ts, server) used by the bot/script.
2. Note that mr_truth.php rendered the victim's authenticated full-site page and stored LP data in its config.
3. After victim regains account and changes password, replay the captured LP credentials against the Long Poll endpoint.
4. Continuously poll `https://<server>?act=a_check&key=<key>&ts=<ts>&wait=25` to receive new private messages.
**How found:** Researcher observed that the 'Молодец' bot's mr_truth.php script exposed the authenticated page and kept Long Poll credentials in its config, then hypothesized those credentials outlive normal session revocation.
**Exploitation:** Attacker who once had account access extracted the Long Poll key/ts/server from the bot's config. These credentials are not tied to a revocable session, so after the victim recovered the account and rotated the password, the attacker kept polling Long Poll and silently read all new private messages. No foreign session appeared in the victim's activity history.
**Insight:** Long Poll / streaming API keys issued to bots or third-party scripts often aren't invalidated by password change or session kill — test whether captured LP key/ts pairs survive account recovery, since they grant silent persistent read access with no session trail.