HackerOne: Session Hijacking attack (Different Scenario)

Hey I was able to replay a cookie of a current active session and hijack that by replaying the cookie. Now this is different from any conventional vanilla session hijacking because it works even when the user is not logged in. But the condition is that the victim's session must be active at the...

HackerOne: Email changing

Hello When someone chnage his email he doesn't have to confirm the change of the email from both emails I suggest you must use a confirmation from both emails specially the old email Because If an attacker compromises the password of a hackone user the user will not be able to reset his password...

HackerOne: Denial of Service

Refering to this 13748 Not yet patched fully. POC video --- https://www.dropbox.com/s/4i7qun3nuesbc70/hackeroneerror.mp4.mp4...

IRCCloud: Reflected XSS in Pastebin-view

The paste ID passed in via the URL in the Pastebin-view is inserted between tags unsanitised. This leads to reflected XSS that bypasses all major XSS protection software Chrome, IE.... Normal request: https://www.irccloud.com/pastebin/nhm4f6pB Proof-of-concept:...

HackerOne: Account takeover

Hello, I found another bug on hackerone. This time it is very dangerous and creative. Hope you will definitely love it. Any valid account on hackerone can be hacked. eg Co-founders @jobert and @michiel can also be hacked. I tried this one on my account only. Lets go to the point ... Things requir...

HackerOne: Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)

Hi, Hope you are good! Steps to repro: 1 Create a HackerOne account having email address "[email protected]". 2 Now Logout and ask for password reset link. Don't use the password reset link. 3 Login using the same password back and update your email address to "[email protected]" and verify the same. 4 Now logout an...

Slack: Password Policy issue (Weak Protect)

Ehy, I don't know if this is valid, but I decide to report it because when I try to report it on hackerone, the issue becomes duplicate, so that's not bad at all, issue valid but duplicate. This is the poc: http://grabilla.com/04616-eda16a72-0174-4eb1-82c6-4716a66b60d1.html Well, let's explain th...

HackerOne: Session not invalidated after password reset

After a password reset link is requested and a user's password is then changed, not all existing sessions are logged out automatically. The automatic removal of existing sessions linked to a user whose password was changed is only the case if the session was initiated with the 'Remember me for a...

HackerOne Bug Bounty Platform Lands Top Microsoft Security Expert

With bug bounties being all the rage, the platforms that support them are emerging as important pieces of the security research, disclosure and reward ecosystem. One of those platforms, HackerOne, has scored a major coup in hiring Katie Moussouris, the driving force behind Microsoft’s bounty...

HackerOne: Potential denial of service in hackerone.com/teams/new

While creating a new team, if I set the bounty to a large value over 1,000,000 digits and send the request the website hangs for about a minute and a half, then pops up an error page saying there is an error on your end...

HackerOne: Improper filtering of classes used in codeblocks in Markdown

Redcarpet just uses the name of the language as the classname of the element. So if the classnames are of significance to the site, one can break the site using this. For instance, this report disables the topbar, and can trigger the user into opening a popup. Proof of concept: js-topbar i eat th...

Bug Bounties Expanding to Individual Developers

Bug bounties once were restricted mainly to large software companies such as Mozilla and Google. But the success of these programs has led many other infrastructure and product companies, including Yahoo, Facebook, Barracuda, PayPal and even Microsoft, to launch their own reward systems. Now, the...

HackerOne: Flooding mailbox of user

There seems to be no prevention from sending multiple password reset links to a selected e-mail. As a result mailbox of the user can be flooded with these mails. I would recommend to add CAPTCHA in forgot password functionality...

HackerOne: All Active user sessions should be deleted when user change his password!

When a user changed his/her password either directly or with reset password flow, existing sessions were kept active. We already invalidate all sessions when a user logs out, but we were not doing the same for password changes. This means that if an attacker were to get access to an account, even...

Google Recommends Developers Support OAuth 2.0

Google announced today that in the coming months it will be more stringent in securing users when they log in to their accounts by applying additional authorization checks. “These additional checks will ensure that only the intended user has access to their account, whether through a browser,...

Localize: Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)

Hello again team of Localize! I have already reported this bug to the HackerOne team..and they fix it..not immediately, because it's low priority but they fix it! Report: https://hackerone.com/reports/3709 : Issue: Strict Transport Security with too short max age. Description: Your site use a goo...

CloudFlare Launches Bug Bounty Program

As the OpenSSL heartbleed saga unfolded over the last couple of weeks, one of the companies that was at the forefront of figuring out the scope and effects of the problem was CloudFlare. The company put up a challenge server, asking researchers to hit it with the heartbleed exploit to determine...

HackerOne: Password Reset Bug

Possible account takeover using the forgot password link even after the email address and password changed. Steps to Reproduce =================================== Create an account in hackerone E.g [email protected] After account verification logout from the account Reset the password for...

HackerOne: Issue with remember_user_token

When a user logs out, cookie named rememberusertoken is invalidated on the user side. When the user log in again with functionality 'remember me for a week', he gets the same value of rememberusertoken as previously. Moreover, when there is only cookie named rememberusertoken in request, the user...

HackerOne: creating titleless and non-closable bugs

Hi, I just found that it's possible to create titleless and non-closable bugs by prepending values for the 'reporttitle' and 'reportvulnerabilityinformation' parameters with '%00' characters respectively. To reproduce: - Create a baseline request via https://hackerone.com/program/reports/new -...