HackerOne: Making any Report Failed to load

Hello, I found a way to make any report failed to load using this code with Hex Character: www.%40ebаy.com I was testing for Homographic Issue using Hex Characters and I listed all of hex character and tried to bypass. Then, when I paste the list and comment it in a report I experienced report...

HackerOne: Missing spf flags for hackerone.com

I just checked for SPF records for the hackerone.com domain, and there are none, effectively allowing for spamspoof to originate from that domain. you can validate by testing yourself here: http://www.kitterman.com/spf/validate.html i want to show you an attack scenario An attacker would send a...

HackerOne: SPF whitelist of mandrill leads to email forgery

I just sent a forged email to [email protected] that appears to originate from [email protected]. I was able to do this because of the following SPF record: dig txt hackerone.com hackerone.com. 299 IN TXT "v=spf1 include:spf.google.com include:sendgrid.net include:mail.zendesk.com...

Dropbox Launches Bounty Program on HackerOne

Dropbox has become the latest high-profile Internet firm to start a bug bounty program, hooking up with HackerOne to provide rewards to security researchers who report vulnerabilities through the program. The new reward system from Dropbox covers a variety of the company’s offerings, including th...

HackerOne: Reflected Filename Download

First of all congratulations on awesome bounty system. Big fan here! I found out that it's possible run a RFD attack on Hackerone. If we visit: https://hackerone.com/dsopas We see the normal HTML webpage. Nothing new here. But if we add ?format=json to the URL we can see the JSON file generated b...

HackerOne: "learn more here", reward email - domain expired.

Hi, Today I received an e-mail about a reward, below the e-mail there is something about drastically reduced fees from Coinbase, to be exactly, the following: Thanks to drastically reduced fees from Coinbase, you are eligible to receive a 5% bonus when you receive your bounty payout in Bitcoin...

HackerOne: Open redirect in "Language change".

Hi guys! Urls: https://hackerone.com//example.com/ru/faq and https://hackerone.com//example.com/faq or https://hackerone.com//example.com/disclosure-guidelines and https://hackerone.com//example.com/ru/disclosure-guidelines scroll down at the right side change the language to English you will go ...

HackerOne: Reflected File Download attack allows attacker to 'upload' executables to hackerone.com domain

Hi hackerone team, I'm a friend of Peiying and am looking for a position at hackerone. While playing around with your product, I found a serious vulnerability in your application: it allows attackers to craft executables on the hackerone.com domain rather than the sandboxed one on S3. 1. attacker...

Adobe Starts Vulnerability Disclosure Program on HackerOne

Update: Adobe is the latest tech vendor to begin a vulnerability disclosure program, but it seems they’re limping in at the outset. The program launched this week on the HackerOne platform, but there are no cash incentives being offered and certain Adobe products are not in scope for researchers...

HackerOne: Improperly validated fields allows injection of arbitrary HTML via spoofed React objects

Note: I haven't yet investigated the implications of this fully, so this may be more severe than I'm currently aware of. Right now the only exploits I'm aware of allow a team member to attack other team members. I've found a couple fields that I'd expect to be limited to string values, but which...

HackerOne: Auto Approval of Invitation to join Team as a Team member

Hi Hackerone, I have found a vulnerability wherein once a Team manager of any team sends out an Invitation to another Hackerone user to join his team, the invited team member gets auto accepted into the team to which he is being invited to join. The choice of "Accept" or "Reject" invitation which...

HackerOne: Substantially weakened authenticity verification when using 'Remember me for a week'

Hello HackerOne, I noticed that in order to access data bound to a user's permissions, say their own bug reports, or CSRF-token, you only need one certain cookie, which is rememberusertoken, and although it is sent when the user uses HackerOne in a normal fashion, the session cookie is ignored an...

HackerOne: Team member invitations to sandboxed teams are not invalidated consistently (v2)

As per our email conversation on ticket 2527, I am giving you a proof of concept of my claim. 1. I have a sandboxed team in hackerone,named movielee. 2. The manager of that team @haxorsistz sends an invite to = ██████████ 3. The link which I received on email was =...

HackerOne: Restrict any user from logging into his account.

Hackerone's destroys user sessions automatically after signing out,changing password etc.So Old sessions are seems to be worthless for any attacker.But I found something,by exploiting this you can restrict any hackerone user to logging into his account. Pre-Requisition I just need one of his old...

HackerOne: Markdown code block sequence makes report unreadable

Proof of Concept Submitting a report/comment with an input like the following "Three backticks followed by a newline followed by -ddd/d" will cause the report to be unreadable I think it's because the parser is crashing? The attached file includes the input that I'm trying with difficulty to...

HackerOne: Markdown parsing issue enables insertion of malicious tags and event handlers

When markdown is being presented as HTML, there seems to be a strange interaction between and @ that lets an attacker insert malicious tags. Proof of Concept http://[email protected] foo=bar is rendered converted to the following HTML: html http://danlec As you can see, the output includes a tag which ca...

HackerOne: Team member invitations to sandboxed teams are not invalidated consistently

hello today i found a Bug about Auth in Send invitation to member to join the team ,, so if Now The Victim Send invition to Another Victim Account to join the team as a Manager,, the link of the invitation is will Be Valid For Many Many Many time to Accept the invtiation from Another Accounts in ...

HackerOne: Insecure Direct Object Reference vulnerability

In the program portal, there is an option to add external people as participants in a bug report. The admin can then remove this person as well if needed. The request for removing an external reporter looks like: DELETE /reports//externalusers/ HTTP/1.1 Host: hackerone.com User-Agent:...

HackerOne: In markdown, parsing things like @danlec and #46072 after links is unsafe

Let me preface this by saying that I haven't worked out an actual exploit for this, and there may not be one, but when 46072 is disclosed, folks will probably be taking a closer look at HackerOne's markdown parsing and may find a way to turn this bug into something It looks like the links for...

HackerOne: Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered

Uh\ oh! Basic POC: Sequences like test\ are rendered as http://test Examples of what could be done with this: Obviously there's a whole variety of stuff that can be done when you can inject arbitrary HTML, even in spite of the CSP protection. We can put in elements we're not supposed to see above...