HackerOne: Hacker can bypass 2FA requirement and reporter blacklist through embedded submission form

Hi Team, Summary: A program owner can enforce the hackers to setup the two-factor authentication before submitting new reports to their program here: https://hackerone.com/parrotsec/submissionrequirements see below image F355169 The Parrot Sec program has this feature enabled to enforce the hacke...

h1-5411-CTF: H1-5411 CTF Writeup

So, Hackerone posted a tweet about the Meme CTF Where barcode was in the tweet image by scanning it and decoding from hex I found this link : https://h1-5411.h1ctf.com/ where we can create/generate a memes and for generating the meme this was used form GitHub which i found in source code analysis...

See how I found Yahoo Mail APP stored XSS vulnerability-vulnerability warning-the black bar safety net

! Today I want to share is to participate in Yahoo（Yahoo!） Vulnerability all test items to find the one on Yahoo Mail iOS app vulnerability, and ultimately, by virtue of the vulnerability, I go into the Yahoo security Hall of Fame and get a$3500 dollar reward. Vulnerability case My test object is...

h1-5411-CTF: Solution for h15411's CTF challenge

Baby steps Earlier today a friend tipped me off about an ongoing CTF challenge that was being run by HackerOne and would get the first ten winners a ticket to participate in h15411, which will be a live-hacking event happening in Buenos Aires. This immediately caught my attention and I decided to...

Brave Software: chrome://brave can still be navigated to, leading to RCE

Summary: 'chrome://brave' can be navigated to using the middle mouse click or normal click with CTRL held IFF coming from a bookmark. I am also using a small bug to actually trick a user into bookmarking our crafted URL through drag and drop. Products affected: Brave: 0.24.0 V8: 6.9.427.23 rev:...

h1-5411-CTF: H1-5411 CTF Write-up by erbbysam and ziot

@erbbysam and I recently set out to beat the latest CTF challenge hosted by HackerOne. Here is a write-up with the process we took from start to finish. The h1-5411 CTF begins with a tweet from HackerOne: https://twitter.com/Hacker0x01/status/1044974142150373378 F351665 This leads to a website...

HackerOne: Hacker can request mediation for published reports

Hi team, @jobert Summary: After creating the publish report, we do not have a field to send the requested meditation from HackerOne Support Description: Steps To Reproduce 1. Create publish report for any program ████████ 2. Use query https://hackerone.com/reports/numberpublishreport/hackerhelp M...

HackerOne: User with privilege to maintain External Programs can update certain churned HackerOne programs

Summary: You wrote that some programs are behind, but you are trying to get them back sorry maybe bad translation Description: Apparently because of a system error, I have access to change information in the public program. This option is given only for external programs.But here is a public...

HackerOne: Discrepancy in hacker profile report count may reveal existence of a private program by publishing a report

Hi team , @pei, @jobert , @bencode Summary: Again We have publish report page https://hackerone.com/hacktivity/publish But we have bypass query 401476 this description The profile page counts the number of created your reports. But it does not consider the reports that are created in the sandbox...

Weblate: Tab nabbing via window.opener

Details: When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. Attack scenario: here i have provided 2 videos, in video 1 i have my editorial link set. to show that tabnapping is...

Command Injection

Overview Versions of egg-scripts before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line. Example: eggctl start --daemon --stderr='/tmp/eggctlstderr.log; touch /tmp/malicious' Recommendation Update to version 2.8.1 or late...

HackerOne: @wearehackerone.com is vulnerable to namespace attacks due to hackerone.com not being RFC2142 compliant.

Hola amigos, First off, I know RFCs are annoying. Second of all, namespace attacks are a btch. With that out of the way, here is an Inti-bug that was discovered as a result of reading RFC2142 very carefully. Brief summary of RFC2142 RFC2142 defines a standard set of email addresses that cover...

HackerOne: Disclosure of top 10 vulnerability types for programs that haven't enabled the Insights feature

Summary Although the report count is not showing, the Insights query endpoint returns a list of top 10 vulnerability types for any programs that haven't enabled the Insights feature. Reproduction 1. Go to a program that has Insights feature enabled, e.g: https://hackerone.com/security/insights 2...

Code Injection

Overview All versions of cryo are vulnerable to code injection due to an Insecure implementation of deserialization. Proof of concept var Cryo = require'cryo'; var frozen = '"root":"CRYOREF3","references":"contents":,"value":"CRYOFUNCTIONfunction console.log\"defconrussia\"; return...

Privilege Escalation due to Blind NoSQL Injection

Overview Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later. References - HackerOne Report - GitHub Advisory...

HackerOne: Internal usage of AdBlockPlus may expose PoC URLs to unknown third-parties

Hello HackerOne team, this is probably going to be a different kind of report than what you are used to: it looks to me this is more of an internal, operational security best-practice that you may choose to follow. This is something that's bugging me from January now, but it took me some time and...

Arbitrary File Write via Archive Extraction

Overview Versions of unzipper before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames ../../file.txt for example. Recommendation Update to version 0.3.18 or later. References - GitHub Pull Request - Zip Slip...

HackerOne: TeamProfile exposes partially sensitive information through GraphQL

I noticed there is new field teamprofile added and using the graphql below the latest serious report and reports received in three months were exposed "query":"query Dashboardreportseveritybreakdowntable$first0:Int! \n query \n id,\n ...F0\n \n\nfragment F0 on Query \n...

Path Traversal

Overview Versions of express-cart before 1.1.7 are vulnerable to Path Traversal. Recommendation Update to version 1.1.7 or later. References - HackerOne Report - GitHub Advisory...

HackerOne: Private program policy page still accessible after user left the program

Hi Team, Summary: I have found a critical sensitive information disclosure, I'm not sure if this is a result of a new hackerone UI update, I observed that some of the UI has been change such as Hacktivity etc. BUG: Now all private program policy page together with the updates is visible to me...