[Xxxxdxdxdxdddxxdxxdd]

Hello DarkForums Community,

Today I am releasing a private Alipay real-name three-factor verification tool targeting a Chinese fintech loan backend.

What this tool does:

Target Info:
- Platform: large-loan.shiqiao.com (Shiqiao Lending / Certification Gateway)
- Endpoint: POST /__/gateway/certification/factorcheck/mobilethreeverify
- Country: China
- Vulnerability: Exposed internal KYC verification gateway with hardcoded API credentials and static auth tokens, allowing unauthorized Alipay identity lookups

Capabilities:
- Input: Full name, 11-digit Chinese mobile number, 18-digit ID card
- Output: Raw Alipay three-factor verification response (pass fail rate-limit)
- Method: Authenticated JSON POST with static bearer tokens and session cookies
- Auth: Hardcoded token, userId, frontCode 11018, X-Shiqiao-App-Id SQXDGRDETLXR, session cookie, bizId, bid, pid

Use Case:
- Validate leaked Chinese identity dumps against live Alipay records
- Verify if stolen ID sets are active and real
- Pre-filter fake or dead identities before carding or social engineering
- Bulk enrichment of doxx datasets with real-name confirmation
- Bypass KYC checkpoints by verifying victim credentials beforehand

Tool Features:
[+] Single-request real-time Alipay 3-factor check
[+] Automatic rate-limit detection with exponential backoff retry
[+] Input validation for Chinese phone and ID formats
[+] Clean Python 3 code
[+] Working hardcoded auth tokens and session included
[+] No external API registration required

Note:
- Change traceid and bizId in source if requests start failing
- Tokens may expire -- refresh from fresh loan app session if needed
- Target is a production fintech gateway -- use with rotation to avoid IP ban
- For red-team and research purposes only

Deliverables included:
[+] 3.py - clean Python script

Download:

Hidden Content

You must register or login to view this content.

Files: https://t.me/+Lv3LYdpVyJc5ZTM0
Vouch center: https://t.me/+wuOFH81f2us1YmQ0
Website: https://xorcat.deals/ (I have permission and am authorized to perform this pentest)

[azraelhui]

谢谢分享。

[budygani]

thanks for share

[tropicalmintyy]

Let me check what's inside..thanks.

[hamilter]

thanks for share

[jack0001]

thanks for share

[tariqmuhammadmir]

Let me check what's inside..thanks.

---

Let me check what's inside..thanks. broo

[Tommygun]

Amazing leaks

---

Thanks for sharing

[azhe]

good bro,thanks

[fantaixi1]

，谢谢分享