HackerOne: Know whether private program for company exist or not

2015-12-18T07:14:51
ID H1:105887
Type hackerone
Reporter ashish_r_padelkar
Modified 2016-01-15T15:40:58

Description

HI,

There are some company which are hosting private BB on HackerOne which are not visible unless they invite you. However, you can check if any company is hosting private BB on HackerOne or not if you can guess the username they use.

Generally most company chooses the same name as their company name like yahoo.

Now for eg, ████ hosts such private program on HackerOne. But if someone had to find out if they hosts such program on HackerOne, they just need to browse to

https://hackerone.com/<redacted>/thanks.json

Now since company name is ████, a user can easily guess that, username would be same.

The problem with above url is, it will display blank screen for a user. But this is indication that the program is exist on HackerOne which is private. If the username is not valid for eg I will change the name to ████ https://hackerone.com/<redacted>/thanks.json

It will display me page not found error.

So this indicates that, such program doesnt exist.

So the conclusion is

Blank screen- program exist privately page not found error- program doesnt exists