+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: Bragging Rights (https://hackforums.net/forumdisplay.php?fid=12)
+---- Thread: Found multiple XSS exploits in MyBB / HackForums (/showthread.php?tid=5859533)
RE: Found multiple XSS exploits in MyBB / HackForums - Bossk - Jul 14, 2018
OP still tryna find some exploits 🤣
Spoiler (Click to View)
![[Image: ed4b6f24895f4ee42d7dd953e2db8c52.png]](https://i.gyazo.com/ed4b6f24895f4ee42d7dd953e2db8c52.png)
👍 RE: Found multiple XSS exploits in MyBB / HackForums - Animeschoolgirl - Jul 14, 2018
Props to you for doing the right thing!
RE: Found multiple XSS exploits in MyBB / HackForums - Punisher - Jul 21, 2018
(Jul 14, 2018 02:45 AM)Bossk Wrote: OP still tryna find some exploits 🤣
Spoiler (Click to View)
Actually found another persistent XSS in MyBB a few days ago. Reported to MyBB and Omni yesterday. 🤝
RE: Found multiple XSS exploits in MyBB / HackForums - 0riginalkillit - Jul 22, 2018
(Jul 14, 2018 02:45 AM)Bossk Wrote: OP still tryna find some exploits 🤣
Spoiler (Click to View)
Hey how did you manage to see the byte history of other member
🤝
RE: Found multiple XSS exploits in MyBB / HackForums - Tʏʟᴇʀ - Jul 22, 2018
(Jul 22, 2018 01:28 AM)0riginalkillit Wrote: Hey how did you manage to see the byte history of other member
🤝
Click the users bytes amount to pull up the popup window as if you're donating then at the bottom right corner, it says History.
RE: Found multiple XSS exploits in MyBB / HackForums - 0riginalkillit - Jul 22, 2018
(Jul 22, 2018 01:39 AM)Tʏʟᴇʀ Wrote: Click the users bytes amount to pull up the popup window as if you're donating then at the bottom right corner, it says History.
It shows my history buddy not other members history
🤝
RE: Found multiple XSS exploits in MyBB / HackForums - Bossk - Jul 22, 2018
(Jul 22, 2018 01:28 AM)0riginalkillit Wrote: Hey how did you manage to see the byte history of other member
🤝
you need a mybb exploit
RE: Found multiple XSS exploits in MyBB / HackForums - 0riginalkillit - Jul 22, 2018
(Jul 22, 2018 03:24 AM)Bossk Wrote: you need a mybb exploit
OK thank you but I did no understand anything 😧 Because I have never been in web exploits
So I will begin to learn it soon 🤝
RE: Found multiple XSS exploits in MyBB / HackForums - Evanescent - Jul 23, 2018
Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.
RE: Found multiple XSS exploits in MyBB / HackForums - Bossk - Jul 23, 2018
(Jul 23, 2018 02:01 AM)Evanescent Wrote: Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.
disallowing it would do nothing but harm because then the blackhats would be able to find and exploit vulnerabilities, while the whitehats wont report the exploits they find in fear of being banned or whatever.
RE: Found multiple XSS exploits in MyBB / HackForums - Elitas - Jul 23, 2018
(Jul 23, 2018 02:01 AM)Evanescent Wrote: Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.
It's allowed. I regularly find vulnerabilities in plugins on here and report it to Omni.
RE: Found multiple XSS exploits in MyBB / HackForums - Evanescent - Jul 23, 2018
(Jul 23, 2018 03:15 AM)Bossk Wrote: disallowing it would do nothing but harm because then the blackhats would be able to find and exploit vulnerabilities, while the whitehats wont report the exploits they find in fear of being banned or whatever.
(Jul 23, 2018 03:19 AM)Elitas Wrote: It's allowed. I regularly find vulnerabilities in plugins on here and report it to Omni.
Alright. Sounds good, I'll give a shot when I'll be free.
RE: Found multiple XSS exploits in MyBB / HackForums - Punisher - Jul 23, 2018
(Jul 23, 2018 02:01 AM)Evanescent Wrote: Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.
Only manual testing is allowed, scripts and scanning can get you banned or even closed
RE: Found multiple XSS exploits in MyBB / HackForums - Krueger - Jul 23, 2018
Gj man not much to say about it besides keep us safe pls xd
RE: Found multiple XSS exploits in MyBB / HackForums - Omniscient - Jul 23, 2018
Pisses me off pretty bad that we reported these very high risk vulns to MyBB and they said patch would be out in 2-3 weeks and they took 3 months. They could have alerted the community and released a simple fix.
This was a report coming from Hack Forums. They should have assumed immediately that this was going to be leaked and used maliciously. We could have pwned hundreds of MyBB forums possibly even thousands in the time they took to release the update.
Even worse, they have not successfully patched the vulnerability.
I gotta say, their MyCode parser has been fucked for many months. It's frustrating that these reports to them aren't immediately dealt with. I've complained to them about their secrecy of development. A high-risk vuln should be made public within 72 hours with a patch.
This was bullshit and I've lost confidence in the team.
Personally I think OP should release the vulns public if only to embarass the team for their lack of security. They deserve nothing less than the middle-finger for this bullshit.