+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [XSS] Yahoo [XSS][UPDATED] (/showthread.php?tid=2959613)
[XSS] Yahoo [XSS][UPDATED] - 01001 - Oct 21, 2012
Hey guys i just found a XSS in yahoo's sub domain.
So, i just want to know whether Yahoo pays for XSS vulnerabilities or not.
If they pay then i will report them, Here is the picture.
![[Image: ApaeM.png]](https://i.imgur.com/ApaeM.png)
I got this reply from them after reporting this vulnerability....😏
![[Image: wswcS.jpg]](https://i.imgur.com/wswcS.jpg)
Lol, How i will look after wearing a Yahoo! Shirt. 😊
* - p0pc0rn - Oct 21, 2012
no.they dont have any cash bounty reward for that.
but i did read few from others blog that yahoo did gave them their T-shirt as token
* - 01001 - Oct 21, 2012
(Oct 21, 2012 05:47 AM)p0pc0rn Wrote: no.they dont have any cash bounty reward for that.
but i did read few from others blog that yahoo did gave them their T-shirt as token
Does yahoo add names to Hall Of Fame or not ?
* - p0pc0rn - Oct 21, 2012
(Oct 21, 2012 05:48 AM)01001 Wrote: Does yahoo add names to Hall Of Fame or not ?
afaik, no.
never know any HOF on their page 😭
* - 01001 - Oct 21, 2012
(Oct 21, 2012 05:52 AM)p0pc0rn Wrote: afaik, no.
never know any HOF on their page 😭
I think i should sell this vulnerability. 😧
* - p0pc0rn - Oct 21, 2012
(Oct 21, 2012 05:54 AM)01001 Wrote: I think i should sell this vulnerability. 😧
haha..try it.maybe there'll be a newbie want to buy so he/she can brag it around his/her friend.
owh btw,nice find 🤝
* - 01001 - Oct 21, 2012
(Oct 21, 2012 05:56 AM)p0pc0rn Wrote: haha..try it.maybe there'll be a newbie want to buy so he/she can brag it around his/her friend.
owh btw,nice find 🤝
Thanks, I have updated the thread with the vulnerable pic.
* - Nitrox - Oct 21, 2012
As per my knowledge Yahoo doesn't pay. Sometimes they don't even acknowledge you. :|
One of my friends reported it, they patched it even without sending him a reply. "Sometimes" they send you a T-Shirt. Sad to see such a big company doing this, when Microsoft atleast has a HOF.
* - SUPER CHAMP - Oct 21, 2012
That is why Yahoo is shit compared to other big giants.
T-shirts? Why don't they just start giving stickers. .
* - Bars - Oct 21, 2012
This is old, or fake. They no longer use the red logo.
* - 01001 - Oct 21, 2012
This is not fake, i can show this to you via TV, and secondly what should i do with this ?
* - razem - Oct 21, 2012
Nice find, but they don't give much...
* - 01001 - Oct 21, 2012
(Oct 21, 2012 08:54 AM)razem Wrote: Nice find, but they don't give much...
Thanks mate, I think i should sell this vulnerability !! 😶
* - EMPIRERAIDER - Oct 21, 2012
Yahoo you need to PAY before some one may find a bigger vulnerabillity and hack you like an SQLi i mean i would be tempted to report a vulnerabillity for google or ,microsoft but for yahoo no they do not even pay so what the point in reporting
* - 01001 - Oct 21, 2012
(Oct 21, 2012 08:57 AM)EMPIRERAIDER Wrote: Yahoo you need to PAY before some one may find a bigger vulnerabillity and hack you like an SQLi i mean i would be tempted to report a vulnerabillity for google or ,microsoft but for yahoo no they do not even pay so what the point in reporting
You are absolutely right mate, there is no point of reporting this to Yahoo, As they does not have even a HOF.