GitHub Doubles Maximum Bug Bounty Payouts

Almost a year to the day since Github announced its bug bounty program, the Git repository said yesterday that it will double its maximum payout to $10,000. Ben Toews, a GitHub staffer, said yesterday that since the launch of the GitHub Security Bug Bounty, 73 previously unknown vulnerabilities...

X (Formerly Twitter): URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ.

Hello Twitter Security Team, I reccomend you to read this report with the maximum attention! This is the same isse that you ever see here: https://hackerone.com/reports/42236 and here https://hackerone.com/reports/32825. Well ,now, the acquisition where I found this domain is: trendrr.tv..Before...

HackerOne: Add text to the title of the page "Thanks"

Hi! We can add text to the title of the page "Thanks" Example: https://hackerone.com/mailru/thanks/2014%20Example%201111111111111111111111111...

HackerOne: HTTPS is not enforced for objects stored by HackerOne on Amazon S3

SSL is not enforced for objects stored by HackerOne on Amazon S3. Currently I see all the screenshots uploaded are stored in Amazon S3 bucket "hackerone-attachments" and by default HTTPS connection is made. However even HTTP connections are open to these URLs indicating that SSL is not enforced b...

HackerOne: Reflected File Download

Info: Reflected File Download is a new web attack vector. It allows an attacker to craft a malicious file and present it to a victim, but there is no file present at the server. It was recently published at the BlackHat Eupore 2014 by Oren Hafif. Link to his presentation is given at the end...

HackerOne: URL Crashing browser. {Tested on firefox, Chrome and Safari}

Hi again Dear, I am facing a strange behavior when I try to access this particular URL https://hackerone.com/reports/10373 I test it on multiple computer with different browser. Browser goes into indefinite loop and disabled right click ,and after some time it crashes . It seems like the problem ...

HackerOne: Issue with password change

When a password is changed in user's profile, then a notification about password change is sent to the user email. This is good. However, user not always gets a notification about password change - when a password is changed via password reset link, then such a notification is not send to the use...

HackerOne: Breaking Bugs as team member

It is possible to break a bug page front-end as a team member. This is how it's done: 1. Go to a bug. 2. Select "Change State" - "Triaged". 3. Enter a random comment. 4. Intercept the POST request, change "message" to "message". The status change will be saved but the message will be null and not...

HackerOne: Logic Issue with Reputation: Boost Reputation Points

Hi, I'm disclosing a bug that can allow a program member to escalate a profile reputation by +2 points indefinitely till the extent he/she wants and the process will be somewhat stealthy as there won't be a trace on member's profile say fake resolved bugs etc. Prologue BugBug - Imaginary program ...

HackerOne: Gain reputation by creating a duplicate of an existing report

Hey team, I have found a way to boost your reputation without any efforts. if a researcher send a report and someone already send same report so he got a duplicate mean 2 points. If he send this issue more multiple times he will got Duplicate again and again. so he can gain more points by this. p...

HackerOne: File Name Enumeration

Hi guys, I am kind of surprised no one hast reported this issue yet. or maybe they have and due to the severity it was never patched? An example of this behavior would be: https://hackerone.com//%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd which is a valid attempt even though we get an error...

HackerOne: Enumeration/Guess of Private (Invited) Programs

Hey, This bug allows anyone to enumerate usernames of invited programs.For example there are two kinds of program at HackerOne - Public programs and Invited programs. Generally invited programs are only accessible to certain users based on reputation system. Now, for most public programs the...

HackerOne: Content Spoofing via reports

The reportid param simply returns whatever entered , instead of showing report id's only. This can result in content injection in the reports field. For example check this one : http://goo.gl/py2V8j...

HackerOne: Ability to see common response titles of other teams (limited)

Hello guys, Not sure what's happening exactly but when I go to my team program dashboard add a new Trigger and then tamper the request and change JSON variable commonresponseid to say 24 and after trigger gets added I see a title of ████████ which is not in my default team template nor added by...

HackerOne: No email verification on username change

Hello Hackerone People This is an issue that i discovered in the username change option. Basically anyone can ask your system to change anyone's username on hackerone. I tested this by mailing at [email protected] to change the username of my friend's account from yhunterz to yahoohuntz whose...

HackerOne: "early preview" programs disclosure

Hi, There is a really small issue, but I think it should be fixed. If you open https://hackerone.com/facebook as guest user not logged, you will be redirected to https://hackerone.com/users/signin, so it shows that facebook page exists and it's private. Correct redirection should be to 404 page...

HackerOne: Window Opener Property Bug

The bug mentioned in 23386 is not yet correctly patched I believe. See, if a user sets his/her profile's website link to a similar page as mentioned in 23386. I mean a page that can manipulate the window.opener property would be able to accomplish similar results as in 23386 Proof-of-Concept: 1...

Twitter Launches Bug Bounty Program

Twitter is the latest major Internet company to establish a bug bounty program, and has put no upper limit on the bounty that a researcher can earn for reporting a vulnerability. The company announced on Wednesday that it will operate its bounty program through the HackerOne platform, a bug bount...

HackerOne: Notification of previous signed out user leakage.

This is a very minor issue in my eye.But I would like to report,as hackerone itself is very cautious about its own security. Steps to reproduce 1. I logged on to hackerone with my team @movielee id.I saw that there were 6 notifications pending.I didnot checked those and logged out. 2. I logged in...

New Facebook Internet Defense Prize Pays Out $50,000 Award

Large technology companies may already have bug bounty programs in place that reward researchers who attack and find holes in software or web platforms. Slowly, some are also starting to institute programs that pay for defensive measures. Facebook is the latest to do so with the implementation of...