HackerOne: Change Any username and profile link in hackerone

HI ,found a vulnerability by which anyone's username or profile link can be changed in hackerone Follow the Steps 1.contact [email protected] by your email [email protected] and ask your name from "abc" to "xyz" 2.You will get a reply saying " for confirmation can you say send an email from yo...

Square Launches Bug Bounty, Hires Top Security Researcher

The bug bounty phenomenon began mainly with major software vendors and security companies, which were the main targets for security researchers and attackers. But it is now moving to virtually every corner of the Web and software ecosystem, and the latest company to join the party is Square, the...

HackerOne: Redirect while opening links in new tabs

Hello HackerOne, I'd like to report to you a nice little bug about opening links in new tabs. When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. POC:...

HackerOne: No option to logout concurrent sessions

Description When I login to Hackerone using two different computers I can easily browse the session concurrently . This means that if an attacker somehow knows password of user by any means he can login using that info and the main user will not get notified. FIX If someone else login to a accoun...

HackerOne: Session Hijacking attack (Different Scenario)

Hey I was able to replay a cookie of a current active session and hijack that by replaying the cookie. Now this is different from any conventional vanilla session hijacking because it works even when the user is not logged in. But the condition is that the victim's session must be active at the...

HackerOne: Email changing

Hello When someone chnage his email he doesn't have to confirm the change of the email from both emails I suggest you must use a confirmation from both emails specially the old email Because If an attacker compromises the password of a hackone user the user will not be able to reset his password...

HackerOne: Denial of Service

Refering to this 13748 Not yet patched fully. POC video --- https://www.dropbox.com/s/4i7qun3nuesbc70/hackeroneerror.mp4.mp4...

IRCCloud: Reflected XSS in Pastebin-view

The paste ID passed in via the URL in the Pastebin-view is inserted between tags unsanitised. This leads to reflected XSS that bypasses all major XSS protection software Chrome, IE.... Normal request: https://www.irccloud.com/pastebin/nhm4f6pB Proof-of-concept:...

HackerOne: Account takeover

Hello, I found another bug on hackerone. This time it is very dangerous and creative. Hope you will definitely love it. Any valid account on hackerone can be hacked. eg Co-founders @jobert and @michiel can also be hacked. I tried this one on my account only. Lets go to the point ... Things requir...

HackerOne: Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)

Hi, Hope you are good! Steps to repro: 1 Create a HackerOne account having email address "[email protected]". 2 Now Logout and ask for password reset link. Don't use the password reset link. 3 Login using the same password back and update your email address to "[email protected]" and verify the same. 4 Now logout an...

Slack: Password Policy issue (Weak Protect)

Ehy, I don't know if this is valid, but I decide to report it because when I try to report it on hackerone, the issue becomes duplicate, so that's not bad at all, issue valid but duplicate. This is the poc: http://grabilla.com/04616-eda16a72-0174-4eb1-82c6-4716a66b60d1.html Well, let's explain th...

HackerOne: Session not invalidated after password reset

After a password reset link is requested and a user's password is then changed, not all existing sessions are logged out automatically. The automatic removal of existing sessions linked to a user whose password was changed is only the case if the session was initiated with the 'Remember me for a...

HackerOne Bug Bounty Platform Lands Top Microsoft Security Expert

With bug bounties being all the rage, the platforms that support them are emerging as important pieces of the security research, disclosure and reward ecosystem. One of those platforms, HackerOne, has scored a major coup in hiring Katie Moussouris, the driving force behind Microsoft’s bounty...

HackerOne: Potential denial of service in hackerone.com/teams/new

While creating a new team, if I set the bounty to a large value over 1,000,000 digits and send the request the website hangs for about a minute and a half, then pops up an error page saying there is an error on your end...

HackerOne: Improper filtering of classes used in codeblocks in Markdown

Redcarpet just uses the name of the language as the classname of the element. So if the classnames are of significance to the site, one can break the site using this. For instance, this report disables the topbar, and can trigger the user into opening a popup. Proof of concept: js-topbar i eat th...

Bug Bounties Expanding to Individual Developers

Bug bounties once were restricted mainly to large software companies such as Mozilla and Google. But the success of these programs has led many other infrastructure and product companies, including Yahoo, Facebook, Barracuda, PayPal and even Microsoft, to launch their own reward systems. Now, the...

HackerOne: Flooding mailbox of user

There seems to be no prevention from sending multiple password reset links to a selected e-mail. As a result mailbox of the user can be flooded with these mails. I would recommend to add CAPTCHA in forgot password functionality...

HackerOne: All Active user sessions should be deleted when user change his password!

When a user changed his/her password either directly or with reset password flow, existing sessions were kept active. We already invalidate all sessions when a user logs out, but we were not doing the same for password changes. This means that if an attacker were to get access to an account, even...

Google Recommends Developers Support OAuth 2.0

Google announced today that in the coming months it will be more stringent in securing users when they log in to their accounts by applying additional authorization checks. “These additional checks will ensure that only the intended user has access to their account, whether through a browser,...

Localize: Criptographic Issue: Strisct Transport Security with not good max age..(TOO SHORT!)

Hello again team of Localize! I have already reported this bug to the HackerOne team..and they fix it..not immediately, because it's low priority but they fix it! Report: https://hackerone.com/reports/3709 : Issue: Strict Transport Security with too short max age. Description: Your site use a goo...