Skip to content

Instantly share code, notes, and snippets.

@securitygab

securitygab/ptt2cef4e3d - ODIDO

Created February 24, 2026 23:46
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save securitygab/4593f2a3a6c95c65d630b98365a298b1 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save securitygab/4593f2a3a6c95c65d630b98365a298b1 to your computer and use it in GitHub Desktop.
Download ZIP
Injected the string ptt2cef4e3d in the usernames body parameter and we have found reflected in the response kek
Raw
gistfile1.txt
Input Reflected Request&Response
< POST /Core/Security/Login?ptt7600efbd= HTTP/1.1
< Host: beheervastmobiel-acc.odido.nl
< User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
< Content-Type: application/x-www-form-urlencoded
< Cookie: .AspNetCore.Antiforgery.Rl6OMZz-eJ8=CfDJ8CAQSoEe-i9LgXoOjiei_gSONg-LkAGG62CElNKLwP4R-ROFTrCGsAjTL2YZHyqK5igBnS5y7JpmJw0L5wnurzK6UnUS2isIrea-By3NTkzUYiaY9aQBW9BDfoEz-sOoMga7xC1KExC8oT-XxOJF92o
< Content-Length: 245
<
< __RequestVerificationToken=CfDJ8CAQSoEe-i9LgXoOjiei_gQM4tqEbyn5BVc7zGnHTtWbTDCS45peJ60Xsh0pmeJYaBQt5D6qpGA6rYut8oquz4ZSpvG7GRhBzDQHgY7NzNQUmwb0AP9MmvkdVdMFU945IoHv5zD9s_IdSLlD8F0wAQs&Password=Secure123456%24&Username=1d3d2d231d2dd4ptt2cef4e3d%60
> HTTP/1.1 200 OK
> Cache-Control: no-cache, no-store
> Pragma: no-cache
> Transfer-Encoding: chunked
> Content-Type: text/html; charset=utf-8
> Server: Microsoft-IIS/10.0
> Strict-Transport-Security: max-age=31536000; includeSubDomains
> X-Frame-Options: DENY
> X-XSS-Protection: 1; mode=block
> X-Content-Type-Options: nosniff
> Referrer-Policy: strict-origin-when-cross-origin
> Content-Security-Policy: object-src 'none'; form-action 'self'; frame-ancestors 'none'
> Cross-Origin-Opener-Policy: same-origin
> Cross-Origin-Embedder-Policy: require-corp
> Cross-Origin-Resource-Policy: same-origin
> Date: Tue, 24 Feb 2026 23:32:56 GMT
>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="author" content="Hybrid SaaS (hybridsaas.com)">
<meta name="Description" content="Hybrid SaaS">
<link rel="icon" href="/images/favicon/favicon.ico?v=BrgVk-cxUI8Zi0osuTlpj1fKnTCtRziIgouW9K12wmM" />
<link rel="apple-touch-icon" href="/images/favicon/favicon-180x180.png?v=PWEiz7zOki5cJT42JkRekmnHANMhbWfYjJCfAereHOE" />
<link rel="manifest" href="/images/favicon/site.webmanifest?v=AuXCK9YnGS6SGFJhKQlCOtVCLrRCXSH0CFpuieBxQoc" />
<link href="/generated/site.css?v=hl29rHbZruDvwxebeZy9jgPNRR_BOQAdagTesKI2sO0" rel="stylesheet" />
<title>Paris - Inloggen</title>
<link href="/vse/login.css?v=VfHS62-Q4m9Q4U8Ob5UPCmlVH9hBhH5D8SMo888cxmA" rel="stylesheet"/>
</head>
<body>
<div class="wrapper">
<div class="login-container block-center mt-4">
<div class="card">
<div class="card-body">
<form novalidate action="/Core/Security/Login" method="post">
<div class="logo">
<div class="d-flex justify-content-center align-items-center "><div class="w-md-30"><svg focusable="false" viewBox="0 0 1130 300" aria-hidden="true" class="vse-svg-icon " b-c6i14ht0j4><title b-c6i14ht0j4>Odido</title>
<path d="M150 300C232.843 300 300 232.843 300 150C300 67.1573 232.843 0 150 0C67.1573 0 0 67.1573 0 150C0 232.843 67.1573 300 150 300Z" fill="#222222"/><path d="M980 300C1062.84 300 1130 232.843 1130 150C1130 67.1573 1062.84 0 980 0C897.157 0 830 67.1573 830 150C830 232.843 897.157 300 980 300Z" fill="#222222"/><path d="M470 150C470 232.84 402.84 300 320 300V0C402.84 0 470 67.16 470 150Z" fill="#222222"/><path d="M810 300C727.16 300 660 232.84 660 150C660 67.16 727.16 0 810 0V300Z" fill="#222222"/><path d="M490 0H640V300H490V0Z" fill="#222222"/></svg>
<p class="text-center text-bold">
Business
</p></div></div>
</div>
<h1 class="header">
Vast op mobiel Portal
</h1>
<div class="input">
<label>
<b>E-mailadres</b>
</label>
<input type="text" class="form-control" placeholder="E-mailadres" data-val="true" data-val-required="The Username field is required." id="Username" name="Username" value="1d3d2d231d2dd4ptt2cef4e3d`" /> // [!code highlight]
</div>
<div class="input">
<label>
<b>Wachtwoord</b>
</label>
<div id="passwordGroup" class="input__group">
<input type="password" class="form-control" placeholder="Wachtwoord" data-val="true" data-val-required="The Password field is required." id="Password" name="Password" />
<button type="button" class="input__icon" onclick="toggle()">
<span class="input__icon--show">
<svg focusable="false" viewBox="0 0 32 32" aria-hidden="true" class="svg-icon "><title></title>
<path d="M31.1875 14.5447L29.9854 15.7468C22.3189 8.08033 9.77197 8.15308 2.0166 15.9094L0.814453 14.7073C3.05902 12.4627 5.67883 10.8305 8.46429 9.77344C6.86731 8.49933 5.96289 6.83289 5.96289 5.04175H7.66309C7.66309 6.60669 8.6875 8.08521 10.4741 9.09839L10.4589 9.12518C11.9982 8.70642 13.5706 8.46508 15.1509 8.39209V3.57495H16.8511V8.37982C18.4624 8.43207 20.0641 8.65961 21.6291 9.07202C23.3881 8.05969 24.398 6.59381 24.398 5.04175H26.0982C26.0982 6.80725 25.2195 8.45148 23.6655 9.71857C26.4116 10.7473 28.9868 12.3441 31.1875 14.5447ZM22.7178 19.7083C22.7178 23.4119 19.7046 26.4251 16.001 26.4251C12.2974 26.4251 9.28417 23.4119 9.28417 19.7083C9.28417 16.0046 12.2974 12.9915 16.001 12.9915C19.7046 12.9915 22.7178 16.0046 22.7178 19.7083ZM21.0176 19.7083C21.0176 16.9421 18.7671 14.6917 16.001 14.6917C13.2349 14.6917 10.9844 16.9421 10.9844 19.7083C10.9844 22.4744 13.2349 24.7249 16.001 24.7249C18.7671 24.7249 21.0176 22.4744 21.0176 19.7083Z" /></svg>
</span>
<span class="input__icon--hidden">
<svg focusable="false" viewBox="0 0 32 32" aria-hidden="true" class="svg-icon "><title></title>
<path d="M10.3889 23.3137L11.6392 22.0635L18.4297 15.272L19.6807 14.022L22.6372 11.0645L23.9636 9.73902L30.1006 3.60108L28.8994 2.39893L22.1777 9.12061C20.4651 8.61915 18.677 8.34742 16.8496 8.28907V3.50001H15.1504V8.30323C13.5508 8.37672 11.9839 8.62135 10.4666 9.03419L10.4727 9.0232C8.68652 8.01075 7.6621 6.53223 7.6621 4.96656H5.96288C5.96288 6.75416 6.86254 8.417 8.45263 9.68995C5.62646 10.7686 3.02245 12.4238 0.814453 14.6323L2.01562 15.8345C5.77734 12.0728 10.7578 9.98511 16.0381 9.95557C17.6594 9.94092 19.2449 10.1475 20.7808 10.5176L18.0566 13.2417C17.408 13.0322 16.7175 12.9165 16 12.9165C12.2969 12.9165 9.28418 15.9297 9.28418 19.6333C9.28418 20.3506 9.3999 21.0408 9.60889 21.6894L2.89942 28.3989L4.10059 29.6011L10.3889 23.3137ZM16.4714 14.6595L16.4714 14.6595C16.5206 14.6663 16.5697 14.6731 16.6191 14.6792L11.0459 20.2524C11.0398 20.2031 11.033 20.1539 11.0262 20.1047C11.0048 19.9494 10.9834 19.7942 10.9834 19.6333C10.9834 16.8672 13.2344 14.6167 16 14.6167C16.1609 14.6167 16.3161 14.6381 16.4714 14.6595ZM24.3389 11.7676C26.4106 12.7175 28.3271 14.0149 29.9844 15.6721L31.1855 14.47C29.5352 12.8193 27.6509 11.4961 25.6177 10.4888L24.3389 11.7676ZM21.0166 19.634C21.0166 18.3699 20.5334 17.2288 19.7554 16.3513L20.9724 15.1343C22.053 16.3259 22.7158 17.9023 22.7158 19.634C22.7158 23.3377 19.7031 26.3508 16 26.3508C14.2681 26.3508 12.6914 25.6877 11.5 24.6067L12.7175 23.3892C13.595 24.1675 14.7358 24.6506 16 24.6506C18.7656 24.6506 21.0166 22.4001 21.0166 19.634Z"/></svg>
</span>
</button>
<script>
const input = document.querySelector('#Password');
const group = document.querySelector('#passwordGroup');
const toggle = () => {
if (input.getAttribute('type') === 'password') {
input.setAttribute('type', 'text');
group.classList.add('input__group--show');
}
else {
input.setAttribute('type', 'password');
group.classList.remove('input__group--show');
}
};
</script>
</div>
</div>
<div class="input text-bold text-danger text-sm">
Gebruikersnaam of wachtwoord incorrect. Probeer opnieuw of herstel je wachtwoord
</div>
<div class="input">
<button type="submit" class="button">
Inloggen
</button>
</div>
<div class="input d-flex justify-content-center">
<a class="text-underline" href="/Core/Security/ForgotPassword">
Wachtwoord vergeten?
</a>
</div>
<input name="__RequestVerificationToken" type="hidden" value="CfDJ8CAQSoEe-i9LgXoOjiei_gRVQe9Xn8Ixjgqmmsf6c3lQ6keC0paDFnjocK59zu70IZ7kjT_dkhX54dDAXlopgnylOXwXNzxu8_Joj5rfzRyRCx6Z9d4KitvfMqcskD9N-dB4K_LEeS6bYnMlvgysvxE" /></form>
</div>
</div>
<div class="text-center mt-1">
v26.02.43675.0
</div>
</div>
</div>
<script src="/generated/site.js?v=E-4uz__uz8K_er_3nfNdylaiXGoTGNL2bU5uKJtOss0"></script>
</body>
</html>
Original Request&Response
< POST /Core/Security/Login HTTP/1.1
< Host: beheervastmobiel-acc.odido.nl
< User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
< Content-Type: application/x-www-form-urlencoded
< Cookie: .AspNetCore.Antiforgery.Rl6OMZz-eJ8=CfDJ8CAQSoEe-i9LgXoOjiei_gSONg-LkAGG62CElNKLwP4R-ROFTrCGsAjTL2YZHyqK5igBnS5y7JpmJw0L5wnurzK6UnUS2isIrea-By3NTkzUYiaY9aQBW9BDfoEz-sOoMga7xC1KExC8oT-XxOJF92o
< Content-Length: 231
<
< __RequestVerificationToken=CfDJ8CAQSoEe-i9LgXoOjiei_gQM4tqEbyn5BVc7zGnHTtWbTDCS45peJ60Xsh0pmeJYaBQt5D6qpGA6rYut8oquz4ZSpvG7GRhBzDQHgY7NzNQUmwb0AP9MmvkdVdMFU945IoHv5zD9s_IdSLlD8F0wAQs&Password=Secure123456%24&Username=1d3d2d231d2dd4
> HTTP/1.1 302
> location: /Core/Security/Login?antiforgery=true
> server: Microsoft-IIS/10.0
> strict-transport-security: max-age=31536000; includeSubDomains
> x-frame-options: DENY
> x-xss-protection: 1; mode=block
> x-content-type-options: nosniff
> referrer-policy: strict-origin-when-cross-origin
> content-security-policy: object-src 'none'; form-action 'self'; frame-ancestors 'none'
> cross-origin-opener-policy: same-origin
> cross-origin-embedder-policy: require-corp
> cross-origin-resource-policy: same-origin
> date: Tue, 24 Feb 2026 23:32:48 GMT
>
<!DOCTYPE html><html lang="en"><head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="author" content="Hybrid SaaS (hybridsaas.com)">
<meta name="Description" content="Hybrid SaaS">
<link rel="icon" href="/images/favicon/favicon.ico?v=BrgVk-cxUI8Zi0osuTlpj1fKnTCtRziIgouW9K12wmM">
<link rel="apple-touch-icon" href="/images/favicon/favicon-180x180.png?v=PWEiz7zOki5cJT42JkRekmnHANMhbWfYjJCfAereHOE">
<link rel="manifest" href="/images/favicon/site.webmanifest?v=AuXCK9YnGS6SGFJhKQlCOtVCLrRCXSH0CFpuieBxQoc">
<link href="/generated/site.css?v=hl29rHbZruDvwxebeZy9jgPNRR_BOQAdagTesKI2sO0" rel="stylesheet">
<title>Paris - Inloggen</title>
<link href="/vse/login.css?v=VfHS62-Q4m9Q4U8Ob5UPCmlVH9hBhH5D8SMo888cxmA" rel="stylesheet">
</head>
<body>
<div class="wrapper">
<div class="login-container block-center mt-4">
<div class="card">
<div class="card-body">
<form novalidate="" action="/Core/Security/Login" method="post">
<div class="logo">
<div class="d-flex justify-content-center align-items-center "><div class="w-md-30"><svg focusable="false" viewBox="0 0 1130 300" aria-hidden="true" class="vse-svg-icon " b-c6i14ht0j4=""><title b-c6i14ht0j4="">Odido</title>
<path d="M150 300C232.843 300 300 232.843 300 150C300 67.1573 232.843 0 150 0C67.1573 0 0 67.1573 0 150C0 232.843 67.1573 300 150 300Z" fill="#222222"></path><path d="M980 300C1062.84 300 1130 232.843 1130 150C1130 67.1573 1062.84 0 980 0C897.157 0 830 67.1573 830 150C830 232.843 897.157 300 980 300Z" fill="#222222"></path><path d="M470 150C470 232.84 402.84 300 320 300V0C402.84 0 470 67.16 470 150Z" fill="#222222"></path><path d="M810 300C727.16 300 660 232.84 660 150C660 67.16 727.16 0 810 0V300Z" fill="#222222"></path><path d="M490 0H640V300H490V0Z" fill="#222222"></path></svg>
<p class="text-center text-bold">
Business
</p></div></div>
</div>
<h1 class="header">
Vast op mobiel Portal
</h1>
<div class="input">
<label>
<b>E-mailadres</b>
</label>
<input type="text" class="form-control" placeholder="E-mailadres" data-val="true" data-val-required="The Username field is required." id="Username" name="Username" value="">
</div>
<div class="input">
<label>
<b>Wachtwoord</b>
</label>
<div id="passwordGroup" class="input__group">
<input type="password" class="form-control" placeholder="Wachtwoord" data-val="true" data-val-required="The Password field is required." id="Password" name="Password">
<button type="button" class="input__icon" onclick="toggle()">
<span class="input__icon--show">
<svg focusable="false" viewBox="0 0 32 32" aria-hidden="true" class="svg-icon "><title></title>
<path d="M31.1875 14.5447L29.9854 15.7468C22.3189 8.08033 9.77197 8.15308 2.0166 15.9094L0.814453 14.7073C3.05902 12.4627 5.67883 10.8305 8.46429 9.77344C6.86731 8.49933 5.96289 6.83289 5.96289 5.04175H7.66309C7.66309 6.60669 8.6875 8.08521 10.4741 9.09839L10.4589 9.12518C11.9982 8.70642 13.5706 8.46508 15.1509 8.39209V3.57495H16.8511V8.37982C18.4624 8.43207 20.0641 8.65961 21.6291 9.07202C23.3881 8.05969 24.398 6.59381 24.398 5.04175H26.0982C26.0982 6.80725 25.2195 8.45148 23.6655 9.71857C26.4116 10.7473 28.9868 12.3441 31.1875 14.5447ZM22.7178 19.7083C22.7178 23.4119 19.7046 26.4251 16.001 26.4251C12.2974 26.4251 9.28417 23.4119 9.28417 19.7083C9.28417 16.0046 12.2974 12.9915 16.001 12.9915C19.7046 12.9915 22.7178 16.0046 22.7178 19.7083ZM21.0176 19.7083C21.0176 16.9421 18.7671 14.6917 16.001 14.6917C13.2349 14.6917 10.9844 16.9421 10.9844 19.7083C10.9844 22.4744 13.2349 24.7249 16.001 24.7249C18.7671 24.7249 21.0176 22.4744 21.0176 19.7083Z"></path></svg>
</span>
<span class="input__icon--hidden">
<svg focusable="false" viewBox="0 0 32 32" aria-hidden="true" class="svg-icon "><title></title>
<path d="M10.3889 23.3137L11.6392 22.0635L18.4297 15.272L19.6807 14.022L22.6372 11.0645L23.9636 9.73902L30.1006 3.60108L28.8994 2.39893L22.1777 9.12061C20.4651 8.61915 18.677 8.34742 16.8496 8.28907V3.50001H15.1504V8.30323C13.5508 8.37672 11.9839 8.62135 10.4666 9.03419L10.4727 9.0232C8.68652 8.01075 7.6621 6.53223 7.6621 4.96656H5.96288C5.96288 6.75416 6.86254 8.417 8.45263 9.68995C5.62646 10.7686 3.02245 12.4238 0.814453 14.6323L2.01562 15.8345C5.77734 12.0728 10.7578 9.98511 16.0381 9.95557C17.6594 9.94092 19.2449 10.1475 20.7808 10.5176L18.0566 13.2417C17.408 13.0322 16.7175 12.9165 16 12.9165C12.2969 12.9165 9.28418 15.9297 9.28418 19.6333C9.28418 20.3506 9.3999 21.0408 9.60889 21.6894L2.89942 28.3989L4.10059 29.6011L10.3889 23.3137ZM16.4714 14.6595L16.4714 14.6595C16.5206 14.6663 16.5697 14.6731 16.6191 14.6792L11.0459 20.2524C11.0398 20.2031 11.033 20.1539 11.0262 20.1047C11.0048 19.9494 10.9834 19.7942 10.9834 19.6333C10.9834 16.8672 13.2344 14.6167 16 14.6167C16.1609 14.6167 16.3161 14.6381 16.4714 14.6595ZM24.3389 11.7676C26.4106 12.7175 28.3271 14.0149 29.9844 15.6721L31.1855 14.47C29.5352 12.8193 27.6509 11.4961 25.6177 10.4888L24.3389 11.7676ZM21.0166 19.634C21.0166 18.3699 20.5334 17.2288 19.7554 16.3513L20.9724 15.1343C22.053 16.3259 22.7158 17.9023 22.7158 19.634C22.7158 23.3377 19.7031 26.3508 16 26.3508C14.2681 26.3508 12.6914 25.6877 11.5 24.6067L12.7175 23.3892C13.595 24.1675 14.7358 24.6506 16 24.6506C18.7656 24.6506 21.0166 22.4001 21.0166 19.634Z"></path></svg>
</span>
</button>
<script>
const input = document.querySelector('#Password');
const group = document.querySelector('#passwordGroup');
const toggle = () => {
if (input.getAttribute('type') === 'password') {
input.setAttribute('type', 'text');
group.classList.add('input__group--show');
}
else {
input.setAttribute('type', 'password');
group.classList.remove('input__group--show');
}
};
</script>
</div>
</div>
<div class="input text-bold text-danger text-sm">
Probeer het opnieuw
</div>
<div class="input">
<button type="submit" class="button">
Inloggen
</button>
</div>
<div class="input d-flex justify-content-center">
<a class="text-underline" href="/Core/Security/ForgotPassword">
Wachtwoord vergeten?
</a>
</div>
<input name="__RequestVerificationToken" type="hidden" value="CfDJ8CAQSoEe-i9LgXoOjiei_gRHn3xOqInOEE7HdKc2sdn7lRV7OLNWAwiuo8-Akb5UcvNp0kwRiObwAQj1zxeiuaWRScOSGW8qZcNNGBmGKoY_RzgQZxnWOhkYqpf2zEgusQTwdR1OkeX_tL2bCZQvCmI"></form>
<hr>
<div class="d-flex flex-column gap-2">
<a class="button button-secondary" href="/Core/Security/RedirectToProvider?scheme=SalesForceAgent">
Log in als Odido Agent
<svg focusable="false" viewBox="0 0 32 32" aria-hidden="true" class="svg-icon "><title></title>
<path d="M19.7339 4.71191L18.5327 5.91406L27.7686 15.1499H0.977051V16.8501H27.7686L18.5327 26.0859L19.7339 27.2881L31.023 16L19.7339 4.71191Z"></path></svg>
</a>
</div>
</div>
</div>
<div class="text-center mt-1">
v26.02.43675.0
</div>
</div>
</div>
<script src="/generated/site.js?v=E-4uz__uz8K_er_3nfNdylaiXGoTGNL2bU5uKJtOss0"></script>
</body></html>
Raw
ptt2cef4e3d - ODIDO
#ShinyHunters -
Last one and then we STOP leaking NOTES
I and Donut noticed that ODIDO web app reflc users input directly in the body of the
HTTP response. So while this behavior does not constitute a vulnerability
on its own Mrs/Mr.Odido. So what we basically did. (We did a ALL scan on you're SERVER-SIDE CLIENT) and TOKENS
Implemented a line of 420 PAYLOADS and of the 420 PAYLOADS 40 SUCCEED !!
no its not only PHISHING
You gave us access threw you're own system ! Stupiddo rofl.....
Input Reflected Request&Response
< POST /Core/Security/Login?ptt7600efbd= HTTP/1.1
< Host: beheervastmobiel-acc.odido.nl
< User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
< Content-Type: application/x-www-form-urlencoded
< Cookie: .AspNetCore.Antiforgery.Rl6OMZz-eJ8=CfDJ8CAQSoEe-i9LgXoOjiei_gSONg-LkAGG62CElNKLwP4R-ROFTrCGsAjTL2YZHyqK5igBnS5y7JpmJw0L5wnurzK6UnUS2isIrea-By3NTkzUYiaY9aQBW9BDfoEz-sOoMga7xC1KExC8oT-XxOJF92o
< Content-Length: 245
<
< __RequestVerificationToken=CfDJ8CAQSoEe-i9LgXoOjiei_gQM4tqEbyn5BVc7zGnHTtWbTDCS45peJ60Xsh0pmeJYaBQt5D6qpGA6rYut8oquz4ZSpvG7GRhBzDQHgY7NzNQUmwb0AP9MmvkdVdMFU945IoHv5zD9s_IdSLlD8F0wAQs&Password=Secure123456%24&Username=1d3d2d231d2dd4ptt2cef4e3d%60
> HTTP/1.1 200 OK
> Cache-Control: no-cache, no-store
> Pragma: no-cache
> Transfer-Encoding: chunked
> Content-Type: text/html; charset=utf-8
> Server: Microsoft-IIS/10.0
> Strict-Transport-Security: max-age=31536000; includeSubDomains
> X-Frame-Options: DENY
> X-XSS-Protection: 1; mode=block
> X-Content-Type-Options: nosniff
> Referrer-Policy: strict-origin-when-cross-origin
> Content-Security-Policy: object-src 'none'; form-action 'self'; frame-ancestors 'none'
> Cross-Origin-Opener-Policy: same-origin
> Cross-Origin-Embedder-Policy: require-corp
> Cross-Origin-Resource-Policy: same-origin
> Date: Tue, 24 Feb 2026 23:32:56 GMT
>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="author" content="Hybrid SaaS (hybridsaas.com)">
<meta name="Description" content="Hybrid SaaS">
<link rel="icon" href="/images/favicon/favicon.ico?v=BrgVk-cxUI8Zi0osuTlpj1fKnTCtRziIgouW9K12wmM" />
<link rel="apple-touch-icon" href="/images/favicon/favicon-180x180.png?v=PWEiz7zOki5cJT42JkRekmnHANMhbWfYjJCfAereHOE" />
<link rel="manifest" href="/images/favicon/site.webmanifest?v=AuXCK9YnGS6SGFJhKQlCOtVCLrRCXSH0CFpuieBxQoc" />
<link href="/generated/site.css?v=hl29rHbZruDvwxebeZy9jgPNRR_BOQAdagTesKI2sO0" rel="stylesheet" />
<title>Paris - Inloggen</title>
<link href="/vse/login.css?v=VfHS62-Q4m9Q4U8Ob5UPCmlVH9hBhH5D8SMo888cxmA" rel="stylesheet"/>
</head>
<body>
<div class="wrapper">
<div class="login-container block-center mt-4">
<div class="card">
<div class="card-body">
<form novalidate action="/Core/Security/Login" method="post">
<div class="logo">
<div class="d-flex justify-content-center align-items-center "><div class="w-md-30"><svg focusable="false" viewBox="0 0 1130 300" aria-hidden="true" class="vse-svg-icon " b-c6i14ht0j4><title b-c6i14ht0j4>Odido</title>
<path d="M150 300C232.843 300 300 232.843 300 150C300 67.1573 232.843 0 150 0C67.1573 0 0 67.1573 0 150C0 232.843 67.1573 300 150 300Z" fill="#222222"/><path d="M980 300C1062.84 300 1130 232.843 1130 150C1130 67.1573 1062.84 0 980 0C897.157 0 830 67.1573 830 150C830 232.843 897.157 300 980 300Z" fill="#222222"/><path d="M470 150C470 232.84 402.84 300 320 300V0C402.84 0 470 67.16 470 150Z" fill="#222222"/><path d="M810 300C727.16 300 660 232.84 660 150C660 67.16 727.16 0 810 0V300Z" fill="#222222"/><path d="M490 0H640V300H490V0Z" fill="#222222"/></svg>
<p class="text-center text-bold">
Business
</p></div></div>
</div>
<h1 class="header">
Vast op mobiel Portal
</h1>
<div class="input">
<label>
<b>E-mailadres</b>
</label>
<input type="text" class="form-control" placeholder="E-mailadres" data-val="true" data-val-required="The Username field is required." id="Username" name="Username" value="1d3d2d231d2dd4ptt2cef4e3d`" />
</div>
<div class="input">
<label>
<b>Wachtwoord</b>
</label>
<div id="passwordGroup" class="input__group">
<input type="password" class="form-control" placeholder="Wachtwoord" data-val="true" data-val-required="The Password field is required." id="Password" name="Password" />
<button type="button" class="input__icon" onclick="toggle()">
<span class="input__icon--show">
<svg focusable="false" viewBox="0 0 32 32" aria-hidden="true" class="svg-icon "><title></title>
<path d="M31.1875 14.5447L29.9854 15.7468C22.3189 8.08033 9.77197 8.15308 2.0166 15.9094L0.814453 14.7073C3.05902 12.4627 5.67883 10.8305 8.46429 9.77344C6.86731 8.49933 5.96289 6.83289 5.96289 5.04175H7.66309C7.66309 6.60669 8.6875 8.08521 10.4741 9.09839L10.4589 9.12518C11.9982 8.70642 13.5706 8.46508 15.1509 8.39209V3.57495H16.8511V8.37982C18.4624 8.43207 20.0641 8.65961 21.6291 9.07202C23.3881 8.05969 24.398 6.59381 24.398 5.04175H26.0982C26.0982 6.80725 25.2195 8.45148 23.6655 9.71857C26.4116 10.7473 28.9868 12.3441 31.1875 14.5447ZM22.7178 19.7083C22.7178 23.4119 19.7046 26.4251 16.001 26.4251C12.2974 26.4251 9.28417 23.4119 9.28417 19.7083C9.28417 16.0046 12.2974 12.9915 16.001 12.9915C19.7046 12.9915 22.7178 16.0046 22.7178 19.7083ZM21.0176 19.7083C21.0176 16.9421 18.7671 14.6917 16.001 14.6917C13.2349 14.6917 10.9844 16.9421 10.9844 19.7083C10.9844 22.4744 13.2349 24.7249 16.001 24.7249C18.7671 24.7249 21.0176 22.4744 21.0176 19.7083Z" /></svg>
</span>
<span class="input__icon--hidden">
<svg focusable="false" viewBox="0 0 32 32" aria-hidden="true" class="svg-icon "><title></title>
<path d="M10.3889 23.3137L11.6392 22.0635L18.4297 15.272L19.6807 14.022L22.6372 11.0645L23.9636 9.73902L30.1006 3.60108L28.8994 2.39893L22.1777 9.12061C20.4651 8.61915 18.677 8.34742 16.8496 8.28907V3.50001H15.1504V8.30323C13.5508 8.37672 11.9839 8.62135 10.4666 9.03419L10.4727 9.0232C8.68652 8.01075 7.6621 6.53223 7.6621 4.96656H5.96288C5.96288 6.75416 6.86254 8.417 8.45263 9.68995C5.62646 10.7686 3.02245 12.4238 0.814453 14.6323L2.01562 15.8345C5.77734 12.0728 10.7578 9.98511 16.0381 9.95557C17.6594 9.94092 19.2449 10.1475 20.7808 10.5176L18.0566 13.2417C17.408 13.0322 16.7175 12.9165 16 12.9165C12.2969 12.9165 9.28418 15.9297 9.28418 19.6333C9.28418 20.3506 9.3999 21.0408 9.60889 21.6894L2.89942 28.3989L4.10059 29.6011L10.3889 23.3137ZM16.4714 14.6595L16.4714 14.6595C16.5206 14.6663 16.5697 14.6731 16.6191 14.6792L11.0459 20.2524C11.0398 20.2031 11.033 20.1539 11.0262 20.1047C11.0048 19.9494 10.9834 19.7942 10.9834 19.6333C10.9834 16.8672 13.2344 14.6167 16 14.6167C16.1609 14.6167 16.3161 14.6381 16.4714 14.6595ZM24.3389 11.7676C26.4106 12.7175 28.3271 14.0149 29.9844 15.6721L31.1855 14.47C29.5352 12.8193 27.6509 11.4961 25.6177 10.4888L24.3389 11.7676ZM21.0166 19.634C21.0166 18.3699 20.5334 17.2288 19.7554 16.3513L20.9724 15.1343C22.053 16.3259 22.7158 17.9023 22.7158 19.634C22.7158 23.3377 19.7031 26.3508 16 26.3508C14.2681 26.3508 12.6914 25.6877 11.5 24.6067L12.7175 23.3892C13.595 24.1675 14.7358 24.6506 16 24.6506C18.7656 24.6506 21.0166 22.4001 21.0166 19.634Z"/></svg>
</span>
</button>
<script>
const input = document.querySelector('#Password');
const group = document.querySelector('#passwordGroup');
const toggle = () => {
if (input.getAttribute('type') === 'password') {
input.setAttribute('type', 'text');
group.classList.add('input__group--show');
}
else {
input.setAttribute('type', 'password');
group.classList.remove('input__group--show');
}
};
</script>
</div>
</div>
<div class="input text-bold text-danger text-sm">
Gebruikersnaam of wachtwoord incorrect. Probeer opnieuw of herstel je wachtwoord
</div>
<div class="input">
<button type="submit" class="button">
Inloggen
</button>
</div>
<div class="input d-flex justify-content-center">
<a class="text-underline" href="/Core/Security/ForgotPassword">
Wachtwoord vergeten?
</a>
</div>
<input name="__RequestVerificationToken" type="hidden" value="CfDJ8CAQSoEe-i9LgXoOjiei_gRVQe9Xn8Ixjgqmmsf6c3lQ6keC0paDFnjocK59zu70IZ7kjT_dkhX54dDAXlopgnylOXwXNzxu8_Joj5rfzRyRCx6Z9d4KitvfMqcskD9N-dB4K_LEeS6bYnMlvgysvxE" /></form>
</div>
</div>
<div class="text-center mt-1">
v26.02.43675.0
</div>
</div>
</div>
<script src="/generated/site.js?v=E-4uz__uz8K_er_3nfNdylaiXGoTGNL2bU5uKJtOss0"></script>
</body>
</html>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment