HackerOne: "early preview" programs disclosure

Hi, There is a really small issue, but I think it should be fixed. If you open https://hackerone.com/facebook as guest user not logged, you will be redirected to https://hackerone.com/users/signin, so it shows that facebook page exists and it's private. Correct redirection should be to 404 page...

HackerOne: Window Opener Property Bug

The bug mentioned in 23386 is not yet correctly patched I believe. See, if a user sets his/her profile's website link to a similar page as mentioned in 23386. I mean a page that can manipulate the window.opener property would be able to accomplish similar results as in 23386 Proof-of-Concept: 1...

Twitter Launches Bug Bounty Program

Twitter is the latest major Internet company to establish a bug bounty program, and has put no upper limit on the bounty that a researcher can earn for reporting a vulnerability. The company announced on Wednesday that it will operate its bounty program through the HackerOne platform, a bug bount...

HackerOne: Notification of previous signed out user leakage.

This is a very minor issue in my eye.But I would like to report,as hackerone itself is very cautious about its own security. Steps to reproduce 1. I logged on to hackerone with my team @movielee id.I saw that there were 6 notifications pending.I didnot checked those and logged out. 2. I logged in...

New Facebook Internet Defense Prize Pays Out $50,000 Award

Large technology companies may already have bug bounty programs in place that reward researchers who attack and find holes in software or web platforms. Slowly, some are also starting to institute programs that pay for defensive measures. Facebook is the latest to do so with the implementation of...

HackerOne: Change Any username and profile link in hackerone

HI ,found a vulnerability by which anyone's username or profile link can be changed in hackerone Follow the Steps 1.contact [email protected] by your email [email protected] and ask your name from "abc" to "xyz" 2.You will get a reply saying " for confirmation can you say send an email from yo...

Square Launches Bug Bounty, Hires Top Security Researcher

The bug bounty phenomenon began mainly with major software vendors and security companies, which were the main targets for security researchers and attackers. But it is now moving to virtually every corner of the Web and software ecosystem, and the latest company to join the party is Square, the...

HackerOne: Redirect while opening links in new tabs

Hello HackerOne, I'd like to report to you a nice little bug about opening links in new tabs. When you open a link in a new tab target="blank" , the page that opens in a new tab can access the initial tab and change it's location using the window.opener property. POC:...

HackerOne: No option to logout concurrent sessions

Description When I login to Hackerone using two different computers I can easily browse the session concurrently . This means that if an attacker somehow knows password of user by any means he can login using that info and the main user will not get notified. FIX If someone else login to a accoun...

HackerOne: Session Hijacking attack (Different Scenario)

Hey I was able to replay a cookie of a current active session and hijack that by replaying the cookie. Now this is different from any conventional vanilla session hijacking because it works even when the user is not logged in. But the condition is that the victim's session must be active at the...

HackerOne: Email changing

Hello When someone chnage his email he doesn't have to confirm the change of the email from both emails I suggest you must use a confirmation from both emails specially the old email Because If an attacker compromises the password of a hackone user the user will not be able to reset his password...

HackerOne: Denial of Service

Refering to this 13748 Not yet patched fully. POC video --- https://www.dropbox.com/s/4i7qun3nuesbc70/hackeroneerror.mp4.mp4...

IRCCloud: Reflected XSS in Pastebin-view

The paste ID passed in via the URL in the Pastebin-view is inserted between tags unsanitised. This leads to reflected XSS that bypasses all major XSS protection software Chrome, IE.... Normal request: https://www.irccloud.com/pastebin/nhm4f6pB Proof-of-concept:...

HackerOne: Account takeover

Hello, I found another bug on hackerone. This time it is very dangerous and creative. Hope you will definitely love it. Any valid account on hackerone can be hacked. eg Co-founders @jobert and @michiel can also be hacked. I tried this one on my account only. Lets go to the point ... Things requir...

HackerOne: Category- Broken Authentication and Session Management (leads to account compromise if some conditions are met)

Hi, Hope you are good! Steps to repro: 1 Create a HackerOne account having email address "[email protected]". 2 Now Logout and ask for password reset link. Don't use the password reset link. 3 Login using the same password back and update your email address to "[email protected]" and verify the same. 4 Now logout an...

Slack: Password Policy issue (Weak Protect)

Ehy, I don't know if this is valid, but I decide to report it because when I try to report it on hackerone, the issue becomes duplicate, so that's not bad at all, issue valid but duplicate. This is the poc: http://grabilla.com/04616-eda16a72-0174-4eb1-82c6-4716a66b60d1.html Well, let's explain th...

HackerOne: Session not invalidated after password reset

After a password reset link is requested and a user's password is then changed, not all existing sessions are logged out automatically. The automatic removal of existing sessions linked to a user whose password was changed is only the case if the session was initiated with the 'Remember me for a...

HackerOne Bug Bounty Platform Lands Top Microsoft Security Expert

With bug bounties being all the rage, the platforms that support them are emerging as important pieces of the security research, disclosure and reward ecosystem. One of those platforms, HackerOne, has scored a major coup in hiring Katie Moussouris, the driving force behind Microsoft’s bounty...

HackerOne: Potential denial of service in hackerone.com/teams/new

While creating a new team, if I set the bounty to a large value over 1,000,000 digits and send the request the website hangs for about a minute and a half, then pops up an error page saying there is an error on your end...

HackerOne: Improper filtering of classes used in codeblocks in Markdown

Redcarpet just uses the name of the language as the classname of the element. So if the classnames are of significance to the site, one can break the site using this. For instance, this report disables the topbar, and can trigger the user into opening a popup. Proof of concept: js-topbar i eat th...