HackerOne: Manipulate report timeline activity by using null byte.

Null bytes are not permitted in report body, or even in report title. But that can be used in the comment section of self-closing for reporter and change-status for team. When a null byte is used as a comment, that report timeline activity disappears! For example:...

HackerOne: Reputation Manipulation (Theoretical)

Hi, I really would appreciate if you are transparent with this or does not close the bug quickly as N/A or something similar because of being purely theoretical. I am assuming HackerOne runs an x86 System. and the INTMAX is 2,147,483,648. I know this because https://hackerone.com/reports/21474836...

HackerOne: Missing Certificate Authority Authorization rule

Certificate Authority Authorization supported by LetsEncrypt and other CAs allows a domain owner to specify which Certificate Authorities should be allowed to issue certificates for the domain. All CAA-compliant certificate authorities should refuse to issue a certificate unless they are the CA o...

HackerOne: Previous attachments can be referenced when creating a new report

Hello When user upload file in comment to report, user can find file ID by two ways: 1. In preview mode - In response to POST method https://hackerone.com/attachments , answer will be something like this: -"id":84577,"name":"mytestfile.png","size":32397 where fileID = 84577 for example 2. If user...

Hack the Pentagon DOD Bug Bounty

MIAMI—Lisa Wiswell’s phone rang off the hook last summer in the throes of the OPM hack. But she wasn’t just answering questions from those whose security clearance and personal data disappeared into the Chinese ether; there were also hackers on the other end of the line offering their help...

HackerOne: AWS S3 bucket writeable for authenticated aws users

Hi All, I know that hackerone-attachments is used for file uploads on reports and so I did a quick scan for similar buckets and found . While I can't confirm if you own it or not, it appears that it is publicly writable using the aws cli. When I tried to write to hackerone-attachments, I get: "mo...

BugCrowd CSV Injection

Description: A vulnerability in the file upload feature allows attackers to send malicious csv files. By using the Microsoft Excel DDE function an attacker can launch arbritary commands on the victims system. Many companies don't allow xslx or docx files to be uploaded by security testers, becaus...

Gratipay: Limit email address length

I can able to add a email address to 255 character or more,as per RFC the maximum length allowed for an email address is 255 characters. For more info : http://stackoverflow.com/questions/386294/what-is-the-maximum-length-of-a-valid-email-address/574698574698 related report:...

HackerOne: DOS Report FILE html inside <code> in markdown

LOOK rezult https://hackerone.com/reports/127809 F82764 POC Copy in F82766 TXT file all and create a new review I warn you , if you do this , then the report cannot open . You can create a report , attach files and replace my files F82764 and F82765 , paste in the contents of the report and creat...

HackerOne: New hacktivity view discloses report IDs of non-public reports

url: https://hackerone.com/hacktivity.json this url reveals information of reporters Report id ./...

HackerOne: New hacktivity view discloses report IDs of non-public reports

The new hacktivity view unintentionally leaked the report IDs of non-public undisclosed reports through react ID's. It has the same root cause as 127620 and was reporter earlier than that, so we decided to award the same bounty. The new hacktivity view unintentionally leaked the report IDs of...

HackerOne: HackerOne Important Emails Notification are sent in clear-text

Our e-mail provider at the time had problems where some e-mails would not be sent out over TLS. Based on data from Google Postmaster Tools, we were seeing as high as 12% of our e-mail from our provider to Google mail servers not encrypted. We opened a case with them on March 31st, 2016, about thi...

Hack The Pentagon Bug Bounty Opens April 18

The Department of Defense announced today that registration for its Hack the Pentagon bug bounty trial program is open, and that the program will be run on the HackerOne platform. The trial of the government’s first bug bounty program will run April 18 to May 12. The DoD said only certain...

Uber Bug Bounty Rewards Loyalty, Promises Transparency

Uber’s bug bounty program emerged from private beta mode yesterday, which it used as a feedback forum for participants in order to develop the public program. “This was pretty unique in its approach,” said HackerOne CTO Alex Rice. Uber’s program is built on the HackerOne platform, and Uber...

HackerOne: External programs revealing info

A bug in an authorization check was found by @1337coder on an endpoint that was showing the members of a team, as well as the team member groups that were set up. Example output: "id":1, "username":"dirk", "name":"dirk", "bio":"", "url":"https://hackerone.com/dirk" , "id":2, "name":"Admin",...

HackerOne: Websites opened from reports can change url of report page

Websites opened from the a hackerone report can change the url of the report page. For example, clicking on a link set to "http://d214mfsab.org/same.html" including this one will change the still-open report page to http://example.com. This works on current versions of Safari including mobile and...

HackerOne: Disclosure of private programs that have an "external" page on HackerOne

Hay again , We know that there are some companies have "external" page on HackerOne : https://hackerone.com/directory?query=type%3Aexternal&sort=name%3Aascending&page=1 Some of those companies are hosting private programs as well , with the same handles We can pick up any program from the externa...

Imgur: XSS via React element spoofing

Hello, I noticed an XSS on imgur. Proof of concept: visit the URL http://imgur.com/vidgif/ticket/aaaaaaaa?errorpropsdangerouslySetInnerHTMLhtml=%3Cimg%20src=a%20onerror=%22alert%27XSS%20on%20%27%2bdocument.domain%22%3E&errorisReactElement=true&errortype=body It's not the simplest case as it...

HackerOne: CSV Injection via the CSV export feature

I've bypassed 111192 by using this string ";=cmd|' /C calc'!A0" without doublequotes. Steps to reproduce are as in 111192. Tested in excel 2003-2013...

HackerOne: Sending emails (via HackerOne) impersonating other users

Hello, This was a very weird behavior that I observed and I am not sure exactly what is causing this but I trust you guys to dig into this more. So, basically in a sandboxed program, when I set a trigger for an auto-response, I am getting emails from the HackerOne platform as a user who has no...