originalityAI-Config

Introduction

1. A config file that demonstrates the vulnerability of user accounts on originality.ai
2. Originality.ai is a software tool that provides highly accurate AI Detection and Plagiarism checks for text.
3. However, due to the lack of a csrf-token and very high rate-limit values, there is a great chance of DDos attacks.
4. This config explores the vulnerability that can be exploited for this attack. \n

Working

1. While originalityAI's login site has mentioned a recaptcha, the POST Login request payload shows captcha as null.

2. The config captuers the access_token for the successive login response. After which, it is used to check if the account has a subscription or not. If yes, then we can capture the API key through the developer's tab, within the network section.

3. This is demonstrated in the code written in the config.

4. The config can be used on automated pentesting software like SilverBullet for performing bruteforce checks on wordlists. However, this issue can be mitigated by enabling Google's V3 Recaptcha along with strict rate limits.

The config provided is strictly to be used for educational purposes only.