Robots Rife With Cybersecurity Holes

Robots with inadequate security could be hacked and cause physical harm or be used to spy on unsuspecting owners in the near future. Researchers at IOActive Labs released a report Wednesday warning that consumer, industrial and service robots in use today have serious security vulnerabilities...

Legal Robot: S3 ACL misconfiguration

Summary: Legal Robot's s3 bucket legalrobot.com is misconfigured. The ACL allows me to access and copy all files. This means that I could go through and copy all the media files on the s3 bucket. I did not attempt to delete any files as I did not want to go too far and affect your operations. Ste...

Legal Robot: Missing restriction on string size in profile fields

Security researcher reported that there was no restriction on the amount of text that could be inserted into a user's profile field. The researcher also demonstrated that when the text size was large enough the service was restarted, resulting in a momentary outage in our non-production environme...

Google Explorer - Google Mass Explorer

+Google Mass Explorer This is a automated robot for google search engine. Make a google search, and parse the results for a especific exploit you define. The options can be listed with --help parameter. Intro: This project is a main project that i will keep upgrading when new exploits are...

Legal Robot: Bypass 8 chars password complexity with 6 chars only due to insecure password reset functionaliy

While password complexity requirements were implemented in the original signup page, these were not added to the password reset page. Thanks to this security researcher's efforts, we've added this functionality there as well...

Legal Robot: Information Disclosure on rate limit defense mechanism

Security researcher showed that we were returning the number of seconds to wait between attempts. While this can be helpful for legitimate users, it's more likely to be exploited by attackers that simply need to set a timer for the number of seconds we return in the error message...

Legal Robot: Cloudflare issue: Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is down

Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is down Cloudflare issue : http://legalrobot-uat.com/ https://tools.pingdom.com/!/dJuXU5/http://legalrobot-uat.com/...

Legal Robot: Near-duplicate accounts allowed with ignored email mutations

A security researcher discovered that near-duplicate accounts like [email protected], [email protected], and [email protected] were all treated as separate accounts, while some email services, like gmail and google apps, treat these as the same account. This issue could lead to excess ema...

Legal Robot: content spoofing

go to 'Sign in to Legal Robot Ideas Portal' this link 'https://legalrobot.ideas.aha.io/portalsession/new' 2.and enters invalid login credential , the user will the redirected to this link:...

Legal Robot: AWS hosting bucket for Legal Robots set as public browse and list contents: s3://legalrobot

Good day, I hope it treats you kindly : Legal Robot looks to use AWS hosting for your website. Description of issue: ===================== The Amazon Bucket s3://legalrobot has been configured to allow Public users access to browse all files on the server. This is a risk as described as it allows...

Legal Robot: CSRF Issue

Found CSRF Issue in https://www.legalrobot.com/beta/nl/ POST Request : POST /webhooks/beta HTTP/1.1 Host: app.legalrobot.com User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:48.0 Gecko/20100101 Firefox/48.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1...

Legal Robot: clickjacking at http://mailboxes.legalrobot-uat.com/

Clickjack test Website is vulnerable to clickjacking!...

Tonight Mr. Robot is Going to Reveal ‘Dream Device For Hackers’

Mr. Robot is the rare show that provides a realistic depiction of hacks and vulnerabilities that are at the forefront of cyber security. This is the reason it’s been the most popular TV show of its kind. Throughout season 1 and season 2, we have seen that connected devices are the entry point of...

Legal Robot: Non-secure requests are not automatically upgraded to HTTPS

Non-secure requests to legalrobot.com/ e.g. http://www.legalrobot.com/ are not automatically upgraded to HTTPS. This is not something you would notice when you use the latest version of modern web browsers such as Google Chrome or Firefox, because legalrobot.com is HSTS preloaded. When a domain i...

Legal Robot: Possible content spoofing due to missing error page

the domain https://www.legalrobot-uat.com is vulnerable to content spoofing. visit the following link for POC...

Legal Robot: 2 vulns

the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...

Legal Robot: Information Disclosure in AWS S3 Bucket

Hi, While this doesn't fall directly under the Program scope, I feel that the subject of this report is directly connected to the primary Legal Robot web properties and would like to inform your team in case this was a misconfiguration concern. I noticed that legalrobot.amazonaws.com is configure...

Legal Robot: Email spoofing possible via Legal Robot domain

Dear Team, There are few email spoofing tools available on for free and one of them is http://emkei.cz/ When i tried to send an email from [email protected] to my mail, it was successful and straight away delivered into my inbox but when i tried to send it from another mail id...

Legal Robot: User Information leak allows user to bypass email verification.

When a user is logged on, the following is sent: ██████ This contains some sensitive information, most notably the email token. A user can use this to bypass email verification and verify any email. In addition, the hashed password is leaked, which could present a vulnerability if a user's accoun...

Legal Robot: User Information sent to client through websockets

Hey, I noticed when monitoring the websocket requests that the account information of many users, including email address, is sent to the client. For example: ██████ ██████████ █████████ ████████ ███████ There's hundreds of these requests, each containing user information. Please let me know if...