Legal Robot: design issue exists on login page

legalrobot allows an user to set email as password only by resetting password either by logged in and changing it into profile password changed succesfully but the user couldn't log in to the app.legalrobot.com because js checks with email and password and it states it couldn't be same also not...

August 23, 2017 – Morning Cyber Coffee Headlines – “Boston Celtics” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 23, 2017 - Headlines No U.S.-Russia Cyber Unit Without Trump Notifying...

August 22, 2017 – Morning Cyber Coffee Headlines – “Hamilton” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 22, 2017 - Headlines The Intelligence Community’s Top 3 Cybersecurity...

Legal Robot: UX: JS error on Password Safety link

Hi Team, The link at https://app.legalrobot.com/account under "Password Safety" seems to be incorrectly configured. On clicking "here's how", I get following error: Uncaught TypeError: Cannot read property 'title' of undefined at Object.click .how 89e4d4e….js?meteorjsresource=true:301 at...

Legal Robot: UX: JS error on Password Safety link

steps https://app.legalrobot.com/account I just signed up to legal robot In my account settings There is a div that contains Password Safety To keep your information secure, Legal Robot periodically checks your password against public lists of hacked passwords here's how. Since your account is...

Legal Robot: Homograph IDNs displayed in Description

The IDN: http://ebаy.com/ is a homograph for the latin ebay.com. if you copy and paste a link, you might think that you are going to ebay.com. in fact, you are going to a homograph url http://xn--eby-7cd.com/ it would be safer to show the punycode version of the url so that it would be apparent...

Legal Robot: Weak Cryptography for Passwords

Hi Team, I saw while creating new account.Password is being encrypted that's good best practice. But Issue is: 1. It is showing in the request What type of encryptionAlgorithm is used in request. 2. I copied the encrypted password and past it online tool http://md5decrypt.net/en/Sha256/ and i was...

Legal Robot: CSP script-src includes "unsafe-inline"

A security researcher pointed out that our Content Security Policy included the unsafe-eval keyword in the script-src directive. I pointed out some low level issue in CSP policy. and great fix by legalrobot team...

Legal Robot: Information Discloser

Affected Url: https://webmail.legalrobot-uat.com/" When i Open This Link Then It Gives An Error In Which information is disclosing about your server type and its version and Os of your server and also port no is shown which is using on your server and open For Proof i am attaching Screenshot...

Legal Robot: Invalid Email Verification

URL: https://app.legalrobot.com/sign-in Email verification is not proper in register page. for ex. [email protected] this is the valid format but [email protected] is also acceptable during registration. Thanks and regards, Prathamesh...

Legal Robot: Profile fields validation mismatch

This report was effectively a duplicate of 260468, but was processed out of order. Since @hulskar was the first to report but we made a mistake, we have awarded the same bounty here as 260468...

Legal Robot: observer.com URL should HTTPS

Summary This is just for the awareness to use HTTPS everywhere, even for outgoing links - where it's possible. Treat this report with some salt, not as in hashes. Navigate to: https://www.legalrobot-uat.com/press/ Example page In the lower part where you find the observer.com Link: observer...

Legal Robot: TabNabbing issue (due to taget=_blank)

Hi team, i get to know in this particular url https://app.legalrobot-uat.com/dmca-safe-harbor and i found one 3rd party url. Issue lies Here : Electronic Frontier Foundation Here i can see you are using target=blank and no more rel tag. Here , target=blank means it will open in another new tab. b...

Legal Robot: Tampering the mail id on chatbox

hi sir , i found a vulnerability i.e tampering the data . steps to reproduce 1 login to https://app.legalrobot-uat.com 2 open https://app.legalrobot-uat.com/account 3 at right side bottom corner , there is a chat symbol. 4 just enter the message there , and capture the request using burpsuite and...

Legal Robot: Incorrect error message

URL: https://app.legalrobot.com/sign-in In register page, When i enter more than 32 character in first name and last name fileld it says password length must be less than 32 characters. Why does password error showing in Name field???...

Legal Robot: Incorrect email content when disabling 2FA

Hello @team, I found that there is false statement in the 2FA disabled mails sent by the legalrobot. what is the issue? When user is disabling the 2fa authenticator app Registration.He will get a notification regarding the Disabling of the 2FA .the mail structure is like this: 2FA disabled The 2F...

Legal Robot: Code injection

A security researcher discovered that they were able to inject potentially malicious code into Legal Robot's newly created Roadmap page through improper input sanitization when submitting a new Idea for consideration by the community. A limited-scope attack was possible since the input sanitizati...

Legal Robot: User enumeration from failed login error message

A security researcher reported an issue around user enumeration through examination of the failed registration error message. Since this change was reported, Legal Robot has switched to a method wherein any registration attempts for accounts that already exist will be redirected to the same...

Legal Robot: app.legalrobot.com opens FireFox but not in FireFox ESR

Your website app.legalrobot.com normal opens in FireFox but when i open with FireFox ESR, the website is redirected to https://browser-update.org/update.html . This is kinda kind annoying for the users who FireFox ESR is already my default installed on their machine also for the people that don't...

Robot Safecracking

Robots can crack safes faster than humans -- and differently: So Seidle started looking for shortcuts. First he found that, like many safes, his SentrySafe had some tolerance for error. If the combination includes a 12, for instance, 11 or 13 would work, too. That simple convenience measure meant...