HackerOne: Able to remove the admin access of my program

Hey Jobert, There is a functional bug in hackerone, using which i am able to make the my program admin free. This shouldn't be happen in the program because atleast one admin be there in program. Request: PUT /sasas/groups/12307 HTTP/1.1 Host: hackerone.com User-Agent: Mozilla/5.0 Macintosh; Inte...

Ubiquiti airOS - Arbitrary File Upload (Metasploit)

Exploit for unix platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ubiquiti airOS Arbitrary File Upload', 'Description' = %q This module exploits a pre-auth fi...

Pornhub Launches Bug Bounty Program; Offering Reward up to $25,000

With the growing number of cyber attacks and data breaches, a significant number of companies and organizations have started Bug Bounty Programs to encourage hackers and security researchers to find and responsibly report bugs in their services and get a reward. Now, even pornography sites are...

HackerOne: Inadequate access controls in "Vote" functionality???

Hello there, First of all let me congratulate you for including pornhub in the list of bug bounty programs, me and my colleagues will have a lot of fun with it hahahahahah. Awesome... Anyways, I stumbled upon something whilst testing hackerone's main site. I don't know if it's a feature that it's...

LocalTapiola: Amazon Bucket Accessible (http://inpref.s3.amazonaws.com/)

Searching through the source code of your homepage shows a few http://inpref.s3.amazonaws.com/ URLS. I assume that you own this s3 Amazon bucket. The problem here is, visiting that amazon bucket on a browser will shows the files on the bucket, whilst a secure bucket would bring up an access denie...

HackerOne: RCE in profile picture upload

Issue ===== The profile picture upload at /settings/profile/edit is vulnerable to remote code execution due to the uploaded file being passed to ImageMagick without checking whether it's an actual image. Combined with the fact that ImageMagick parses ASCII text as so called MVG Magic Vector...

HackerOne: Manipulate report timeline activity by using null byte.

Null bytes are not permitted in report body, or even in report title. But that can be used in the comment section of self-closing for reporter and change-status for team. When a null byte is used as a comment, that report timeline activity disappears! For example:...

HackerOne: Reputation Manipulation (Theoretical)

Hi, I really would appreciate if you are transparent with this or does not close the bug quickly as N/A or something similar because of being purely theoretical. I am assuming HackerOne runs an x86 System. and the INTMAX is 2,147,483,648. I know this because https://hackerone.com/reports/21474836...

HackerOne: Missing Certificate Authority Authorization rule

Certificate Authority Authorization supported by LetsEncrypt and other CAs allows a domain owner to specify which Certificate Authorities should be allowed to issue certificates for the domain. All CAA-compliant certificate authorities should refuse to issue a certificate unless they are the CA o...

HackerOne: Previous attachments can be referenced when creating a new report

Hello When user upload file in comment to report, user can find file ID by two ways: 1. In preview mode - In response to POST method https://hackerone.com/attachments , answer will be something like this: -"id":84577,"name":"mytestfile.png","size":32397 where fileID = 84577 for example 2. If user...

Hack the Pentagon DOD Bug Bounty

MIAMI—Lisa Wiswell’s phone rang off the hook last summer in the throes of the OPM hack. But she wasn’t just answering questions from those whose security clearance and personal data disappeared into the Chinese ether; there were also hackers on the other end of the line offering their help...

HackerOne: AWS S3 bucket writeable for authenticated aws users

Hi All, I know that hackerone-attachments is used for file uploads on reports and so I did a quick scan for similar buckets and found . While I can't confirm if you own it or not, it appears that it is publicly writable using the aws cli. When I tried to write to hackerone-attachments, I get: "mo...

BugCrowd CSV Injection

Description: A vulnerability in the file upload feature allows attackers to send malicious csv files. By using the Microsoft Excel DDE function an attacker can launch arbritary commands on the victims system. Many companies don't allow xslx or docx files to be uploaded by security testers, becaus...

Gratipay: Limit email address length

I can able to add a email address to 255 character or more,as per RFC the maximum length allowed for an email address is 255 characters. For more info : http://stackoverflow.com/questions/386294/what-is-the-maximum-length-of-a-valid-email-address/574698574698 related report:...

HackerOne: DOS Report FILE html inside <code> in markdown

LOOK rezult https://hackerone.com/reports/127809 F82764 POC Copy in F82766 TXT file all and create a new review I warn you , if you do this , then the report cannot open . You can create a report , attach files and replace my files F82764 and F82765 , paste in the contents of the report and creat...

HackerOne: New hacktivity view discloses report IDs of non-public reports

url: https://hackerone.com/hacktivity.json this url reveals information of reporters Report id ./...

HackerOne: New hacktivity view discloses report IDs of non-public reports

The new hacktivity view unintentionally leaked the report IDs of non-public undisclosed reports through react ID's. It has the same root cause as 127620 and was reporter earlier than that, so we decided to award the same bounty. The new hacktivity view unintentionally leaked the report IDs of...

HackerOne: HackerOne Important Emails Notification are sent in clear-text

Our e-mail provider at the time had problems where some e-mails would not be sent out over TLS. Based on data from Google Postmaster Tools, we were seeing as high as 12% of our e-mail from our provider to Google mail servers not encrypted. We opened a case with them on March 31st, 2016, about thi...

Hack The Pentagon Bug Bounty Opens April 18

The Department of Defense announced today that registration for its Hack the Pentagon bug bounty trial program is open, and that the program will be run on the HackerOne platform. The trial of the government’s first bug bounty program will run April 18 to May 12. The DoD said only certain...

Uber Bug Bounty Rewards Loyalty, Promises Transparency

Uber’s bug bounty program emerged from private beta mode yesterday, which it used as a feedback forum for participants in order to develop the public program. “This was pretty unique in its approach,” said HackerOne CTO Alex Rice. Uber’s program is built on the HackerOne platform, and Uber...