I created a notion page for ethical hacking course!
Save it before it gets deleted!
Hackerone got hacked! How can I steal your POC? 🥷🏻
• Weakness - Sensitive Information Disclosure
• Bounty - $15,000
• CC - Hasyim
Critical bugs directly upstream (Hackerone) as a bug bounty platform :
https://kresec.medium.com/hackerone-got-hacked-how-can-i-steal-your-poc-01a9132c5aeb
There are various User Mode File System (FUSE)–based file systems for Unix-like operating systems (for example, Linux) that can be used to mount an S3 bucket as a file system. The semantics of the Amazon S3 file system are not that of a POSIX file system, so the file system may not behave entirely as expected.
Читать полностью…Seems that is unpossible to execute php file, cause s3 bucket used as file storage
Читать полностью…i change the method to put i can upload file i have to copy past binary down there
Читать полностью…Thanks for the clarification.
Unfortunately, the program staff sent a message after he Traiged it few hours after submission that the emails and usernames are dummy data by retool but he hasn't close the report.
During bug bounty I came across a env.js file with Some of what I see are survicateapi key, Google API key, some APIs url, froalapi key, profitwell API key, survicatesurvey id, Google recaptcha site key, some configuration, Braintree token, etc
Читать полностью…You need to search what that does with your information e can't actually determine what you can do next
Читать полностью…Hi
I found apple developer merchant id file in a website but when i reported i got informative on it
Is there anyway i can make it a bug ?
hello write me on russian language and i maybe help u. Because my english is very bad and i don`t understood you
Читать полностью…Yeah he is right.
Majority of PII goes to Medium unless you can use it to escalate more like if email is associated with anyone in the company and using that email you Bypass some admin or higher authority.
That's when it goes for critical or high!