This is an Exploit App I made when solving the iOTConnect from MobileHackingLab.
This app behaves like a Central hub for all iOT devices connected to the same network, it allows the user to turn the devices ON/OFF remotely
through the app. All new accounts created through the app are of the guest privilege. Guests can't control some devices like A/C, Speaker, etc.
There exists a Master Switch that can be used to switch ON all devices. You need to have the 3 digit PIN to flip the switch. Even if a guest account has this PIN, they still can't flip the switch. Your account needs to be privileged to use this Master Switch feature.
This app exploits a vulnerability in the source code to successfully brute force the 3-digit PIN and flip the Master Switch at the same time.
Reach Out to me: