Legal Robot: Cloudflare issue: Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is down

Error 521 Ray ID: 2e7ea7f706ea4056 • 2016-09-25 12:59:55 UTC Web server is down Cloudflare issue : http://legalrobot-uat.com/ https://tools.pingdom.com/!/dJuXU5/http://legalrobot-uat.com/...

Legal Robot: Near-duplicate accounts allowed with ignored email mutations

A security researcher discovered that near-duplicate accounts like [email protected], [email protected], and [email protected] were all treated as separate accounts, while some email services, like gmail and google apps, treat these as the same account. This issue could lead to excess ema...

Legal Robot: content spoofing

go to 'Sign in to Legal Robot Ideas Portal' this link 'https://legalrobot.ideas.aha.io/portalsession/new' 2.and enters invalid login credential , the user will the redirected to this link:...

Legal Robot: AWS hosting bucket for Legal Robots set as public browse and list contents: s3://legalrobot

Good day, I hope it treats you kindly : Legal Robot looks to use AWS hosting for your website. Description of issue: ===================== The Amazon Bucket s3://legalrobot has been configured to allow Public users access to browse all files on the server. This is a risk as described as it allows...

Legal Robot: CSRF Issue

Found CSRF Issue in https://www.legalrobot.com/beta/nl/ POST Request : POST /webhooks/beta HTTP/1.1 Host: app.legalrobot.com User-Agent: Mozilla/5.0 X11; Ubuntu; Linux x8664; rv:48.0 Gecko/20100101 Firefox/48.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1...

Legal Robot: clickjacking at http://mailboxes.legalrobot-uat.com/

Clickjack test Website is vulnerable to clickjacking!...

Tonight Mr. Robot is Going to Reveal ‘Dream Device For Hackers’

Mr. Robot is the rare show that provides a realistic depiction of hacks and vulnerabilities that are at the forefront of cyber security. This is the reason it’s been the most popular TV show of its kind. Throughout season 1 and season 2, we have seen that connected devices are the entry point of...

Legal Robot: Non-secure requests are not automatically upgraded to HTTPS

Non-secure requests to legalrobot.com/ e.g. http://www.legalrobot.com/ are not automatically upgraded to HTTPS. This is not something you would notice when you use the latest version of modern web browsers such as Google Chrome or Firefox, because legalrobot.com is HSTS preloaded. When a domain i...

Legal Robot: Possible content spoofing due to missing error page

the domain https://www.legalrobot-uat.com is vulnerable to content spoofing. visit the following link for POC...

Legal Robot: 2 vulns

the first report is concerning AWS S3 bucket Readable for authenticated aws users , the same as this report 163476 the bucket is sdk.amazonaws.com , i believe it's yours because i found it in a Head request to https://app.legalrobot.com/ : F115189 listing the bucket : 115190 i don't have any...

Legal Robot: Information Disclosure in AWS S3 Bucket

Hi, While this doesn't fall directly under the Program scope, I feel that the subject of this report is directly connected to the primary Legal Robot web properties and would like to inform your team in case this was a misconfiguration concern. I noticed that legalrobot.amazonaws.com is configure...

Legal Robot: Email spoofing possible via Legal Robot domain

Dear Team, There are few email spoofing tools available on for free and one of them is http://emkei.cz/ When i tried to send an email from [email protected] to my mail, it was successful and straight away delivered into my inbox but when i tried to send it from another mail id...

Legal Robot: User Information leak allows user to bypass email verification.

When a user is logged on, the following is sent: ██████ This contains some sensitive information, most notably the email token. A user can use this to bypass email verification and verify any email. In addition, the hashed password is leaked, which could present a vulnerability if a user's accoun...

Legal Robot: User Information sent to client through websockets

Hey, I noticed when monitoring the websocket requests that the account information of many users, including email address, is sent to the client. For example: ██████ ██████████ █████████ ████████ ███████ There's hundreds of these requests, each containing user information. Please let me know if...

Hacker reports Vulnerability in Mr. Robot Season 2 Website

Mr. Robot was the biggest 'Hacking Drama' television show of 2015 and its second season will return to American TV screens on Wednesday 13th of July 2016. However, the new promotional website for season two of Mr. Robot has recently patched a security flaw that could have easily allowed a hacker ...

openSUSE Security Update : java-1_7_0-openjdk (openSUSE-2016-431)

This update for java-170-openjdk fixes the following issues : java-170-openjdk was updated to 2.6.5 - OpenJDK 7u99 boo972468 - Security fixes - S8152335, CVE-2016-0636: Improve MethodHandle consistency - Import of OpenJDK 7 u99 build 0 - S6425769, PR2858: Allow specifying an address to bind JMX...

スーパーロボット大戦X-Ω - Customized SSL, Redefined SSL Common Names verifier, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application スーパーロボット大戦X-Ω published at the 'play' market has multiple vulnerabilities...

Figuromo Kids : Robot - Customized SSL, WebView SSL handling enabled, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Figuromo Kids : Robot published at the 'play' market has multiple vulnerabilities...

Robot match - Base64 encoded String, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Robot match published at the 'play' market has multiple vulnerabilities...

Robot Defense - Corrupted files, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Robot Defense published at the 'play' market has multiple vulnerabilities...