HackerOne: Markdown parsing issue enables insertion of malicious tags and event handlers

When markdown is being presented as HTML, there seems to be a strange interaction between and @ that lets an attacker insert malicious tags. Proof of Concept http://[email protected] foo=bar is rendered converted to the following HTML: html http://danlec As you can see, the output includes a tag which ca...

HackerOne: Team member invitations to sandboxed teams are not invalidated consistently

hello today i found a Bug about Auth in Send invitation to member to join the team ,, so if Now The Victim Send invition to Another Victim Account to join the team as a Manager,, the link of the invitation is will Be Valid For Many Many Many time to Accept the invtiation from Another Accounts in ...

HackerOne: Insecure Direct Object Reference vulnerability

In the program portal, there is an option to add external people as participants in a bug report. The admin can then remove this person as well if needed. The request for removing an external reporter looks like: DELETE /reports//externalusers/ HTTP/1.1 Host: hackerone.com User-Agent:...

HackerOne: In markdown, parsing things like @danlec and #46072 after links is unsafe

Let me preface this by saying that I haven't worked out an actual exploit for this, and there may not be one, but when 46072 is disclosed, folks will probably be taking a closer look at HackerOne's markdown parsing and may find a way to turn this bug into something It looks like the links for...

HackerOne: Vulnerability with the way \ escaped characters in <http://danlec.com> style links are rendered

Uh\ oh! Basic POC: Sequences like test\ are rendered as http://test Examples of what could be done with this: Obviously there's a whole variety of stuff that can be done when you can inject arbitrary HTML, even in spite of the CSP protection. We can put in elements we're not supposed to see above...

GitHub Doubles Maximum Bug Bounty Payouts

Almost a year to the day since Github announced its bug bounty program, the Git repository said yesterday that it will double its maximum payout to $10,000. Ben Toews, a GitHub staffer, said yesterday that since the launch of the GitHub Security Bug Bounty, 73 previously unknown vulnerabilities...

X (Formerly Twitter): URGENT - SUBDOMAIN TAKEOVER ON TWITTER ACQ.

Hello Twitter Security Team, I reccomend you to read this report with the maximum attention! This is the same isse that you ever see here: https://hackerone.com/reports/42236 and here https://hackerone.com/reports/32825. Well ,now, the acquisition where I found this domain is: trendrr.tv..Before...

HackerOne: Add text to the title of the page "Thanks"

Hi! We can add text to the title of the page "Thanks" Example: https://hackerone.com/mailru/thanks/2014%20Example%201111111111111111111111111...

HackerOne: HTTPS is not enforced for objects stored by HackerOne on Amazon S3

SSL is not enforced for objects stored by HackerOne on Amazon S3. Currently I see all the screenshots uploaded are stored in Amazon S3 bucket "hackerone-attachments" and by default HTTPS connection is made. However even HTTP connections are open to these URLs indicating that SSL is not enforced b...

HackerOne: Reflected File Download

Info: Reflected File Download is a new web attack vector. It allows an attacker to craft a malicious file and present it to a victim, but there is no file present at the server. It was recently published at the BlackHat Eupore 2014 by Oren Hafif. Link to his presentation is given at the end...

HackerOne: URL Crashing browser. {Tested on firefox, Chrome and Safari}

Hi again Dear, I am facing a strange behavior when I try to access this particular URL https://hackerone.com/reports/10373 I test it on multiple computer with different browser. Browser goes into indefinite loop and disabled right click ,and after some time it crashes . It seems like the problem ...

HackerOne: Issue with password change

When a password is changed in user's profile, then a notification about password change is sent to the user email. This is good. However, user not always gets a notification about password change - when a password is changed via password reset link, then such a notification is not send to the use...

HackerOne: Breaking Bugs as team member

It is possible to break a bug page front-end as a team member. This is how it's done: 1. Go to a bug. 2. Select "Change State" - "Triaged". 3. Enter a random comment. 4. Intercept the POST request, change "message" to "message". The status change will be saved but the message will be null and not...

HackerOne: Logic Issue with Reputation: Boost Reputation Points

Hi, I'm disclosing a bug that can allow a program member to escalate a profile reputation by +2 points indefinitely till the extent he/she wants and the process will be somewhat stealthy as there won't be a trace on member's profile say fake resolved bugs etc. Prologue BugBug - Imaginary program ...

HackerOne: Gain reputation by creating a duplicate of an existing report

Hey team, I have found a way to boost your reputation without any efforts. if a researcher send a report and someone already send same report so he got a duplicate mean 2 points. If he send this issue more multiple times he will got Duplicate again and again. so he can gain more points by this. p...

HackerOne: File Name Enumeration

Hi guys, I am kind of surprised no one hast reported this issue yet. or maybe they have and due to the severity it was never patched? An example of this behavior would be: https://hackerone.com//%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd which is a valid attempt even though we get an error...

HackerOne: Enumeration/Guess of Private (Invited) Programs

Hey, This bug allows anyone to enumerate usernames of invited programs.For example there are two kinds of program at HackerOne - Public programs and Invited programs. Generally invited programs are only accessible to certain users based on reputation system. Now, for most public programs the...

HackerOne: Content Spoofing via reports

The reportid param simply returns whatever entered , instead of showing report id's only. This can result in content injection in the reports field. For example check this one : http://goo.gl/py2V8j...

HackerOne: Ability to see common response titles of other teams (limited)

Hello guys, Not sure what's happening exactly but when I go to my team program dashboard add a new Trigger and then tamper the request and change JSON variable commonresponseid to say 24 and after trigger gets added I see a title of ████████ which is not in my default team template nor added by...

HackerOne: No email verification on username change

Hello Hackerone People This is an issue that i discovered in the username change option. Basically anyone can ask your system to change anyone's username on hackerone. I tested this by mailing at [email protected] to change the username of my friend's account from yhunterz to yahoohuntz whose...