ID H1:13602
Type hackerone
Reporter mac123
Modified 2014-07-08T10:00:32
Description
factlink is not expiring sessions immediately after logout
-
log on to https://staging.factlink.com/
-
Open HTTP LIVE HEADERS and login in https://staging.factlink.com/ with your correct username and password
-
capture request for ex click on settings ( https://staging.factlink.com/user/user_name/edit)
4.and immediately logout the website
-
replay the captured request and your logged back into your account without any username and password
{"id": "H1:13602", "type": "hackerone", "bulletinFamily": "bugbounty", "title": "Factlink: Session not expired on logout", "description": "factlink is not expiring sessions immediately after logout\r\n\r\n1. log on to https://staging.factlink.com/\r\n\r\n2. Open HTTP LIVE HEADERS and login in https://staging.factlink.com/ with your correct username and password \r\n3. capture request for ex click on settings ( https://staging.factlink.com/user/user_name/edit)\r\n4.and immediately logout the website \r\n\r\n5. replay the captured request and your logged back into your account without any username and password", "published": "2014-05-27T10:41:45", "modified": "2014-07-08T10:00:32", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://hackerone.com/reports/13602", "reporter": "mac123", "references": [], "cvelist": [], "lastseen": "2018-04-19T17:34:12", "viewCount": 4, "enchantments": {"score": {"value": 1.0, "vector": "NONE", "modified": "2018-04-19T17:34:12", "rev": 2}, "dependencies": {"references": [], "modified": "2018-04-19T17:34:12", "rev": 2}, "vulnersScore": 1.0}, "bounty": 0.0, "bountyState": "informative", "h1team": {"profile_picture_urls": {"medium": "https://profile-photos.hackerone-user-content.com/000/000/003/56ae64480bf7ab3e95e944a6c198d8b4bf593bf2_medium.jpg?1383694553", "small": "https://profile-photos.hackerone-user-content.com/000/000/003/8f2fe141158fc6fb407c083eb72309a9e5997cd9_small.jpg?1383694553"}, "handle": "factlink", "url": "https://hackerone.com/factlink"}, "h1reporter": {"hacker_mediation": false, "disabled": false, "username": "mac123", "is_me?": false, "profile_picture_urls": {"small": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png"}, "hackerone_triager": false, "url": "/mac123"}, "immutableFields": []}
{}