HackerOne: Reflected File Download

Info: Reflected File Download is a new web attack vector. It allows an attacker to craft a malicious file and present it to a victim, but there is no file present at the server. It was recently published at the BlackHat Eupore 2014 by Oren Hafif. Link to his presentation is given at the end...

HackerOne: URL Crashing browser. {Tested on firefox, Chrome and Safari}

Hi again Dear, I am facing a strange behavior when I try to access this particular URL https://hackerone.com/reports/10373 I test it on multiple computer with different browser. Browser goes into indefinite loop and disabled right click ,and after some time it crashes . It seems like the problem ...

HackerOne: Issue with password change

When a password is changed in user's profile, then a notification about password change is sent to the user email. This is good. However, user not always gets a notification about password change - when a password is changed via password reset link, then such a notification is not send to the use...

HackerOne: Breaking Bugs as team member

It is possible to break a bug page front-end as a team member. This is how it's done: 1. Go to a bug. 2. Select "Change State" - "Triaged". 3. Enter a random comment. 4. Intercept the POST request, change "message" to "message". The status change will be saved but the message will be null and not...

HackerOne: Logic Issue with Reputation: Boost Reputation Points

Hi, I'm disclosing a bug that can allow a program member to escalate a profile reputation by +2 points indefinitely till the extent he/she wants and the process will be somewhat stealthy as there won't be a trace on member's profile say fake resolved bugs etc. Prologue BugBug - Imaginary program ...

HackerOne: Gain reputation by creating a duplicate of an existing report

Hey team, I have found a way to boost your reputation without any efforts. if a researcher send a report and someone already send same report so he got a duplicate mean 2 points. If he send this issue more multiple times he will got Duplicate again and again. so he can gain more points by this. p...

HackerOne: File Name Enumeration

Hi guys, I am kind of surprised no one hast reported this issue yet. or maybe they have and due to the severity it was never patched? An example of this behavior would be: https://hackerone.com//%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd which is a valid attempt even though we get an error...

HackerOne: Enumeration/Guess of Private (Invited) Programs

Hey, This bug allows anyone to enumerate usernames of invited programs.For example there are two kinds of program at HackerOne - Public programs and Invited programs. Generally invited programs are only accessible to certain users based on reputation system. Now, for most public programs the...

HackerOne: Content Spoofing via reports

The reportid param simply returns whatever entered , instead of showing report id's only. This can result in content injection in the reports field. For example check this one : http://goo.gl/py2V8j...

HackerOne: Ability to see common response titles of other teams (limited)

Hello guys, Not sure what's happening exactly but when I go to my team program dashboard add a new Trigger and then tamper the request and change JSON variable commonresponseid to say 24 and after trigger gets added I see a title of ████████ which is not in my default team template nor added by...

HackerOne: No email verification on username change

Hello Hackerone People This is an issue that i discovered in the username change option. Basically anyone can ask your system to change anyone's username on hackerone. I tested this by mailing at [email protected] to change the username of my friend's account from yhunterz to yahoohuntz whose...

HackerOne: "early preview" programs disclosure

Hi, There is a really small issue, but I think it should be fixed. If you open https://hackerone.com/facebook as guest user not logged, you will be redirected to https://hackerone.com/users/signin, so it shows that facebook page exists and it's private. Correct redirection should be to 404 page...

HackerOne: Window Opener Property Bug

The bug mentioned in 23386 is not yet correctly patched I believe. See, if a user sets his/her profile's website link to a similar page as mentioned in 23386. I mean a page that can manipulate the window.opener property would be able to accomplish similar results as in 23386 Proof-of-Concept: 1...

Twitter Launches Bug Bounty Program

Twitter is the latest major Internet company to establish a bug bounty program, and has put no upper limit on the bounty that a researcher can earn for reporting a vulnerability. The company announced on Wednesday that it will operate its bounty program through the HackerOne platform, a bug bount...

HackerOne: Notification of previous signed out user leakage.

This is a very minor issue in my eye.But I would like to report,as hackerone itself is very cautious about its own security. Steps to reproduce 1. I logged on to hackerone with my team @movielee id.I saw that there were 6 notifications pending.I didnot checked those and logged out. 2. I logged in...

New Facebook Internet Defense Prize Pays Out $50,000 Award

Large technology companies may already have bug bounty programs in place that reward researchers who attack and find holes in software or web platforms. Slowly, some are also starting to institute programs that pay for defensive measures. Facebook is the latest to do so with the implementation of...

HackerOne: Change Any username and profile link in hackerone

HI ,found a vulnerability by which anyone's username or profile link can be changed in hackerone Follow the Steps 1.contact [email protected] by your email [email protected] and ask your name from "abc" to "xyz" 2.You will get a reply saying " for confirmation can you say send an email from yo...

Square Launches Bug Bounty, Hires Top Security Researcher

The bug bounty phenomenon began mainly with major software vendors and security companies, which were the main targets for security researchers and attackers. But it is now moving to virtually every corner of the Web and software ecosystem, and the latest company to join the party is Square, the...

HackerOne: Redirect while opening links in new tabs

Hello HackerOne, I'd like to report to you a nice little bug about opening links in new tabs. When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. POC:...

HackerOne: No option to logout concurrent sessions

Description When I login to Hackerone using two different computers I can easily browse the session concurrently . This means that if an attacker somehow knows password of user by any means he can login using that info and the main user will not get notified. FIX If someone else login to a accoun...