[Chking18]

Hello DarkForums Community,

Today I am releasing a private Alipay real-name three-factor verification tool targeting a Chinese fintech loan backend.

What this tool does:

Target Info:
- Platform: large-loan.shiqiao.com (Shiqiao Lending / Certification Gateway)
- Endpoint: POST /__/gateway/certification/factorcheck/mobilethreeverify
- Country: China
- Vulnerability: Exposed internal KYC verification gateway with hardcoded API credentials and static auth tokens, allowing unauthorized Alipay identity lookups

Capabilities:
- Input: Full name, 11-digit Chinese mobile number, 18-digit ID card
- Output: Raw Alipay three-factor verification response (pass fail rate-limit)
- Method: Authenticated JSON POST with static bearer tokens and session cookies
- Auth: Hardcoded token, userId, frontCode 11018, X-Shiqiao-App-Id SQXDGRDETLXR, session cookie, bizId, bid, pid

Use Case:
- Validate leaked Chinese identity dumps against live Alipay records
- Verify if stolen ID sets are active and real
- Pre-filter fake or dead identities before carding or social engineering
- Bulk enrichment of doxx datasets with real-name confirmation
- Bypass KYC checkpoints by verifying victim credentials beforehand

Tool Features:
[+] Single-request real-time Alipay 3-factor check
[+] Automatic rate-limit detection with exponential backoff retry
[+] Input validation for Chinese phone and ID formats
[+] Clean Python 3 code
[+] Working hardcoded auth tokens and session included
[+] No external API registration required

Note:
- Change traceid and bizId in source if requests start failing
- Tokens may expire -- refresh from fresh loan app session if needed
- Target is a production fintech gateway -- use with rotation to avoid IP ban
- For red-team and research purposes only

Deliverables included:
[+] 3.py - clean Python script

Download:


Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)

[anjingbasah]

thanks buddy

[yhnu11]

I want to see the data ,thank u

[lvqijun]

大家好，DarkForums 社区的各位，

今天我发布了一款针对中国金融科技贷款后端的私有支付宝实名三因素验证工具。

此工具的功能：

目标信息：
- 平台：large-loan.shiqiao.com（石桥借贷/认证网关）
- 端点：POST /__/gateway/certification/factorcheck/mobilethreeverify
- 国家/地区：中国
- 漏洞：暴露的内部 KYC 验证网关，其中包含硬编码的 API 凭证和静态认证令牌，允许未经授权的支付宝身份查询。

功能：
- 输入：全名、11 位中国手机号码、18 位身份证号码
- 输出：原始支付宝三因素验证响应（通过/失败率限制）
- 方法：使用静态 bearer 令牌和会话 cookie 的已认证 JSON POST
请求 - 认证信息：硬编码令牌、userId、frontCode 11018、X-Shiqiao-App-Id SQXDGRDETLXR、会话 cookie、bizId、bid、pid。

应用场景：
- 将泄露的中国身份信息与有效的支付宝记录进行比对
- 验证被盗身份信息是否有效且真实
- 预先过滤虚假或失效的身份信息在盗刷信用卡或进行社交工程攻击之前进行身份验证
- 使用实名确认批量丰富 doxx 数据集
- 通过预先验证受害者凭证绕过 KYC 检查

点 工具功能：
[+] 单请求实时支付宝三因素验证
[+] 使用指数退避重试自动检测速率限制
[+] 验证中国手机号码和身份证格式的输入
[+] 简洁的 Python 3 代码
[+] 包含可用的硬编码身份验证令牌和会话
[+] 无需外部 API 注册

注意：
- 如果请求开始失败，请更改源代码中的 traceid 和 bizId
- 令牌可能会过期 -- 如果需要，请从新的贷款应用程序会话中刷新 -
目标是生产环境中的金融科技网关 -- 使用轮换方式以避免 IP 封禁
- 仅供红队演练和研究用途

交付物包括：
[+] 3.py - 简洁的 Python 脚本

下载：


文件：https://t.me/+Lv3LYdpVyJc5ZTM0
担保中心：https://t.me/+wuOFH81f2us1YmQ0
网站： https://xorcat.deals/ （我已获得许可和授权执行此渗透测试）

[lvqijun]

大家好，DarkForums 社区的各位，

今天我发布了一款针对中国金融科技贷款后端的私有支付宝实名三因素验证工具。

此工具的功能：

目标信息：
- 平台：large-loan.shiqiao.com（石桥借贷/认证网关）
- 端点：POST /__/gateway/certification/factorcheck/mobilethreeverify
- 国家/地区：中国
- 漏洞：暴露的内部 KYC 验证网关，其中包含硬编码的 API 凭证和静态认证令牌，允许未经授权的支付宝身份查询。

功能：
- 输入：全名、11 位中国手机号码、18 位身份证号码
- 输出：原始支付宝三因素验证响应（通过/失败率限制）
- 方法：使用静态 bearer 令牌和会话 cookie 的已认证 JSON POST
请求 - 认证信息：硬编码令牌、userId、frontCode 11018、X-Shiqiao-App-Id SQXDGRDETLXR、会话 cookie、bizId、bid、pid。

应用场景：
- 将泄露的中国身份信息与有效的支付宝记录进行比对
- 验证被盗身份信息是否有效且真实
- 预先过滤虚假或失效的身份信息在盗刷信用卡或进行社交工程攻击之前进行身份验证
- 使用实名确认批量丰富 doxx 数据集
- 通过预先验证受害者凭证绕过 KYC 检查

点 工具功能：
[+] 单请求实时支付宝三因素验证
[+] 使用指数退避重试自动检测速率限制
[+] 验证中国手机号码和身份证格式的输入
[+] 简洁的 Python 3 代码
[+] 包含可用的硬编码身份验证令牌和会话
[+] 无需外部 API 注册

注意：
- 如果请求开始失败，请更改源代码中的 traceid 和 bizId
- 令牌可能会过期 -- 如果需要，请从新的贷款应用程序会话中刷新 -
目标是生产环境中的金融科技网关 -- 使用轮换方式以避免 IP 封禁
- 仅供红队演练和研究用途

交付物包括：
[+] 3.py - 简洁的 Python 脚本

下载：


文件：https://t.me/+Lv3LYdpVyJc5ZTM0
担保中心：https://t.me/+wuOFH81f2us1YmQ0
网站： https://xorcat.deals/ （我已获得许可和授权执行此渗透测试）

[teqlly]

thanks for sharing

[laogou]

thank you bro

[Obsidian]

thx share

[pinkdragon_888]

Hello DarkForums Community,

Today I am releasing a private Alipay real-name three-factor verification tool targeting a Chinese fintech loan backend.

What this tool does:

Target Info:
- Platform: large-loan.shiqiao.com (Shiqiao Lending / Certification Gateway)
- Endpoint: POST /__/gateway/certification/factorcheck/mobilethreeverify
- Country: China
- Vulnerability: Exposed internal KYC verification gateway with hardcoded API credentials and static auth tokens, allowing unauthorized Alipay identity lookups

Capabilities:
- Input: Full name, 11-digit Chinese mobile number, 18-digit ID card
- Output: Raw Alipay three-factor verification response (pass fail rate-limit)
- Method: Authenticated JSON POST with static bearer tokens and session cookies
- Auth: Hardcoded token, userId, frontCode 11018, X-Shiqiao-App-Id SQXDGRDETLXR, session cookie, bizId, bid, pid

Use Case:
- Validate leaked Chinese identity dumps against live Alipay records
- Verify if stolen ID sets are active and real
- Pre-filter fake or dead identities before carding or social engineering
- Bulk enrichment of doxx datasets with real-name confirmation
- Bypass KYC checkpoints by verifying victim credentials beforehand

Tool Features:
[+] Single-request real-time Alipay 3-factor check
[+] Automatic rate-limit detection with exponential backoff retry
[+] Input validation for Chinese phone and ID formats
[+] Clean Python 3 code
[+] Working hardcoded auth tokens and session included
[+] No external API registration required

Note:
- Change traceid and bizId in source if requests start failing
- Tokens may expire -- refresh from fresh loan app session if needed
- Target is a production fintech gateway -- use with rotation to avoid IP ban
- For red-team and research purposes only

Deliverables included:
[+] 3.py - clean Python script

Download:


Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)

[TheEndofEverything]

Hello DarkForums Community,

Today I am releasing a private Alipay real-name three-factor verification tool targeting a Chinese fintech loan backend.

What this tool does:

Target Info:
- Platform: large-loan.shiqiao.com (Shiqiao Lending / Certification Gateway)
- Endpoint: POST /__/gateway/certification/factorcheck/mobilethreeverify
- Country: China
- Vulnerability: Exposed internal KYC verification gateway with hardcoded API credentials and static auth tokens, allowing unauthorized Alipay identity lookups

Capabilities:
- Input: Full name, 11-digit Chinese mobile number, 18-digit ID card
- Output: Raw Alipay three-factor verification response (pass fail rate-limit)
- Method: Authenticated JSON POST with static bearer tokens and session cookies
- Auth: Hardcoded token, userId, frontCode 11018, X-Shiqiao-App-Id SQXDGRDETLXR, session cookie, bizId, bid, pid

Use Case:
- Validate leaked Chinese identity dumps against live Alipay records
- Verify if stolen ID sets are active and real
- Pre-filter fake or dead identities before carding or social engineering
- Bulk enrichment of doxx datasets with real-name confirmation
- Bypass KYC checkpoints by verifying victim credentials beforehand

Tool Features:
[+] Single-request real-time Alipay 3-factor check
[+] Automatic rate-limit detection with exponential backoff retry
[+] Input validation for Chinese phone and ID formats
[+] Clean Python 3 code
[+] Working hardcoded auth tokens and session included
[+] No external API registration required

Note:
- Change traceid and bizId in source if requests start failing
- Tokens may expire -- refresh from fresh loan app session if needed
- Target is a production fintech gateway -- use with rotation to avoid IP ban
- For red-team and research purposes only

Deliverables included:
[+] 3.py - clean Python script

Download:


Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)