HackerOne: Private program activity timeline information disclosure

2016-02-12T02:16:41
ID H1:116029
Type hackerone
Reporter charfe
Modified 2016-03-16T12:26:36

Description

HI,

There are some company which are hosting as external https://hackerone.com/directory?query=type%3Aexternal&sort=name%3Aascending&page=1

but some one was hosting private BB on HackerOne which are not visible unless they invite you. However, you can check if any company is hosting private BB on HackerOne or not if you can guess the username they use.

Poc https://hackerone.com/<redacted> : its external bb but the have a private bb

now let's discloure there activites : https://hackerone.com/<redacted>/activities.json

and you can use it to check if they are private bb or not Generally most company chooses the same name as their company name like yahoo.

Cheers, @tws_charfeddine