HackerOne: Marking notifications as read CSRF bug

how to make unread notifications read! this happens cause of GET https://hackerone.com/notifications/markasread Host: hackerone.com User-Agent: Mozilla/5.0 Windows NT 6.1; rv:28.0 Gecko/20100101 Firefox/28.0 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-US,en;q=0.5...

HackerOne: javascript: and mailto: links are allowed on users' profiles

For user's Profile settings, you accept website URLs like mailto:[email protected] and even javascript:alert1. The Content Security Policy directive in Chrome catches the JavaScript one, but older browsers will almost certainly execute the code, allowing for session stealing or XSS code execution...

HackerOne: Accepting Invalid characters on email address

I tried to change my email address on hackerone.com.And when I tried adding null Bytes,it was being accepted by hackerone.com. I am registered wth ███ and I tried to change my email address to ████%00 And guess what,this address was granted as an email address...

HackerOne: Securing sensitive pages from SearchBots

I reported the issue earlier Report 3662 .But instead of asking more information,you just closed the bug.Well,you said you never seen google indexing authentication tokens. okCupid,is a client of hackerone.com.Let's see whats google doing with their tokens: Search with the following dork:...

HackerOne: Adding an user email address to the list before confirming.

I know many of the penetration tester's email address.And many of them will be interested to join on hackerone. Well lets think of a scenario. I used some other penetration tester's email address to create an account on hackerone.And I choosed the username to be "somethingerotic" I know that user...

HackerOne: Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)

Hello team of HackerOne! I am Simone, and today I will report you a criptographic issue on your site! Issue: Strict Transport Security with too short max age. Description: Your site use a good "Strict Transport Security" but with short MAX AGE! Severity: See more information below. Proof of Conce...

HackerOne: Weird Bug - Ability to see partial of other user's notification

I was browsing through the pages and suddenly I saw this at my notification: Screenshot: ███ The two yahoo bug notification are definitely not mine as I've not reported any bugs to Yahoo, while the Slack's report is mine. I can't really explain what happened as I do not know it myself. I seem to ...

HackerOne: Hackerone Email Addresses Enumeration

Enumeration of email addresses of already registered users is possible, and or, checking if a user with specific email address is registered in the website and will then be used for phising attacks or any malicious intent. In the "Forgot Password" section, there is an implemented security measure...

HackerOne: CSS leaks SCSS debug info

Download CSS style sheet referenced from the HTML and do: grep -oP "file.:.?scss" application-facbdb64a504bb08ec272860320e1941.css | sort | uniq As you can see it exposes information about the file system, source CSS files and software used. See enclosed file for a dump of the output of the comma...

HackerOne: harvesting attack on user registration

url: https://hackerone.com/users/signup user account registration will ask for the applicant to provide all of the information required to create an account on a registration page. When the registration page is submitted, the application validates the uniqueness of the username and email address...

HackerOne: DNS Misconfiguration

Your localhost.hackerone.com has address 127.0.0.1 and this may lead to "Same- Site" Scripting. Here is detailed description of this minor security issue by Tavis Ormandy: http://www.securityfocus.com/archive/1/486606/30/0/threaded...

HackerOne: LinkedIN URL should be HTTPS

Not really a security bug, but I think will be a good idea to add HTTPS on LinkedIN Share Button. Example page In the right side of page: https://hackerone.com/reports/547 LinkedIN redirect to HTTPS after click, but cookie is sent on the network before that. Thanks!...

HackerOne: Autocomplete enabled in Paypal preferences

Data entered in these fields will be cached by the browser. An attacker who can access the victim's browser could steal this information...

HackerOne: Enumeration of users

As I can see, you prevent enumeration of users actually e-mails of registered users in Sign In https://hackerone.com/users/signin and Forgot password https://hackerone.com/users/password/new functionalities. However, the users can be enumerated in Sign Up https://hackerone.com/users/signup - just...

HackerOne: A password reset page does not properly validate the authenticity token at the server side.

Go to https://hackerone.com/users/password/new and request a new password. 2. go to email, and click on the link. 3. put the new password, submit and intercept the request; remove the authenticity token from the request and now forward it to the server. 4. you will see request still got...

HackerOne: Improper session management

When a request with an invalid authenticitytoken is received, the user is logged out tested for updating user's profile, which is available here: https://hackerone.com/diekatze/profile/edit and the user receives a new session cookie, which is not authenticated at this point. However, the...

HackerOne: Switching the user to the attacker's account

Two requests are needed to make it happen. Request1 log out the user: Request2 log in the user to the attacker's account: Please let me know if more detailed description is needed. Regards, Dawid Czagan...

HackerOne: Email spoofing

There are few email spoofing tool is available free.one them is http://emkei.cz/ when I tried to send a email from ███████ to my email ,it was successful but when i tried to send the another from ██████ , i did not receive any email.Hence, there might be some configuration missing in your mail...

HackerOne: Logical issues with account settings

earlier email was not allowed to change ,but now there is no verification on changing email. when user try to change the password , they were asked to verify the request by entering old password. For the same reason a verification should be there on changing email.The worst part is hackone send...

HackerOne: DNS Cache Poisoning

I noticed if I made a request to your website, intercepted the request, and added the header... X-Forwarded-Host: evil.com it would redirect me to evil.com. Well, after that, I tried going to hackerone.com and I was instantly redirected to evil.com. This is a result of DNS cache poisoning...