Get the latest tech news
Bruteforcing the phone number of any Google user
From rate limits to no limits: How IPv6's massive address space and a crafty botguard bypass left every Google user's phone number vulnerable
< Back A few months ago, I disabled javascript on my browser while testing if there were any Google services left that still worked without JS in the modern web. Optimizing it further By using libphonenumbers's number validation, I was able to generate a format.json with mobile phone prefix, known area codes and digits count for every country. Country codeTime requiredUnited States (+1)20 minsUnited Kingdom (+44)4 minsNetherlands (+31)15 secsSingapore (+65)5 secsThis time can also be significantly reduced through phone number hints from password reset flows in other services such as PayPal, which provide several more digits (ex.+14•••••1779)
Or read this on Hacker News
