4 ms·
Yeah... I recently uncovered a way to bypass the tor browser bundle proxy on some linux flavors [0]. Unfortunately, The bounty from the tor project isn't nearly
by julianj 9y ago
Yeah... I recently uncovered a way to bypass the tor browser bundle proxy on some linux flavors [0]. Unfortunately, The bounty from the tor project isn't nearly as much[1], but at least I can sleep at night.
[0] https://blog.torproject.org/blog/tor-browser-703-released https://blog.torproject.org/blog/tor-browser-703-released
[1] https://hackerone.com/torproject https://hackerone.com/torproject
- r3bl 9y agoGood job! If it's not a secret, how much did they pay to you? Seems like this could be considered, at least, a medium severity, and the top bounty they gave so far is only $500. If you don't wanna disclose that, that's perfectly understandable. I'm just curious.
- julianj 9y agoI haven't received a payment yet actually -- it is still pending.
- gcp 9y agoUnfortunately, The bounty from the tor project isn't nearly as much It sounds like it's a privacy leak, but not an RCE/SBX? Especially as it's saying that the sandboxed version of Tor isn't affected. Bit sad that you can't click the revisions on https://trac.torproject.org/projects/tor/ticket/23044#no2 https://trac.torproject.org/projects/tor/ticket/23044#no2 to see the diff.
- julianj 9y agoSo I believe the max bounty without a bonus for any Tor vuln through their bug bounty program is 4k. The max for the Tor Browser Bundle is 3k.