4 ms·
Reminds me of this hilarious bug bounty: 1. Person reports some vuln in HackerOne itself to HackerOne 2. A HackerOne employee tries to reproduce it, and unkno
by Thorrez 3y ago
Reminds me of this hilarious bug bounty:
1. Person reports some vuln in HackerOne itself to HackerOne
2. A HackerOne employee tries to reproduce it, and unknowlingly copies and pastes his/her cookies into the HackerOne report
3. The reporter takes those cookies, and logs in as the HackerOne employee
4. The reporter files a new vuln report "You are disclose for me you session. you are gevi me your session on last report. I am can use your session(sorry)"
5. $20,000 bounty
https://hackerone.com/reports/745324 https://hackerone.com/reports/745324
- 7sidedmarble 3y agoThat seems to kind of go against the spirit of doing the work to find a vulnerability. It's basically social engineering. Do you get bug bounties for that?
- Thorrez 3y agoI wouldn't call it social engineering, because the reporter didn't intend to get the cookies while filing the first report. It's like the Github scanner that reports leaked tokens.
- asciii 3y agoWhat's crazy is that the reporter previously filed a bug report about hijacking sessions and then it comes full circle during a different report. That's karma
- starttoaster 3y agoI'd argue it's with the spirit, it's just that the vulnerability resides within your employees rather than your systems. Both are worth a call out and correcting. It's arguable how much either is worth, that being said.
- averageRoyalty 3y agoThe spirit of HackerOne is to encourage hackers to disclose rather than exploit for the reward of money. It makes a lot of sense that they's pay generously as a public statement to any hackers that find vulnerabilities on their systems.
- gumby 3y agoWhat a great and hilarious story. Thanks!
- 1B05H1N 3y agoBest part is the guy has a -5 rep.