+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [Vulnerability] New Minecraft.net XSS Vulnerability (/showthread.php?tid=4863326)
Pages: Pages
1
2
[Vulnerability] New Minecraft.net XSS Vulnerability - Ɲorman Bates - Jun 13, 2015
This exploit was found by this awesome guy.
(Didn't know he had HF, but he's been on my skype for awhile lol)
* - Fractal - Jun 13, 2015
Nice find man. 🤝
* - ThePenumbra - Jun 13, 2015
Good job on finding that. Would report it to them if I were you.
* - Ɲorman Bates - Jun 13, 2015
(Jun 13, 2015 02:23 PM)ThePenumbra Wrote: Good job on finding that. Would report it to them if I were you.
Don't want to report it, want to see if anyone can do anything with this
* - HaxOr❤ - Jun 13, 2015
It's POST XSS mate. Pretty much useless.
* - ThePenumbra - Jun 13, 2015
(Jun 13, 2015 03:18 PM)HaxOr❤ Wrote: It's POST XSS mate. Pretty much useless.
Sorry Haxxy baby, but are you dumb o.o?
I can make a link which on click auto-submits a POST request.
OP, got skype/xmpp?
If yes, PM me it.
* - Fractal - Jun 13, 2015
Harder to use, yes, but it's more dangerous as you don't see it in the requested URL. Either way this should be reported to Mojang, maybe you'll get some money for finding the exploit.
* - ThePenumbra - Jun 13, 2015
(Jun 13, 2015 03:21 PM)Fractal Wrote: Harder to use, yes, but it's more dangerous as you don't see it in the requested URL. Either way this should be reported to Mojang, maybe you'll get some money for finding the exploit.
Why is it harder to use?
It's really easy.
Make a form, use js to auto-submit it.
Ez fucking pz.
* - Fractal - Jun 13, 2015
(Jun 13, 2015 03:23 PM)ThePenumbra Wrote: Why is it harder to use?
It's really easy.
Make a form, use js to auto-submit it.
Ez fucking pz.
Exactly, JavaScript/HTML is required to make it work. Hence why it's harder to use on people, or implement. I totally agree with you, it's not useless.
* - SIM-1241186 - Jun 13, 2015
(Jun 13, 2015 03:20 PM)ThePenumbra Wrote: Sorry Haxxy baby, but are you dumb o.o?
I can make a link which on click auto-submits a POST request.
OP, got skype/xmpp?
If yes, PM me it.
You did not just call HaxOr❤ dumb 🤫
* - Angel-sama❤️ - Jun 13, 2015
Wow what a great find. I've been trying to do something with it so far. :)
* - Ɲorman Bates - Jun 13, 2015
(Jun 13, 2015 07:51 PM)Angel-sama Wrote: Wow what a great find. I've been trying to do something with it so far. :)
No one done anything with it yet? Waiting for a big hax0r to get something done
* - ThePenumbra - Jun 14, 2015
(Jun 13, 2015 11:47 PM)Yani Wrote: That form has CSRF protection and your auto-submit thing would never work.
Didn't notice that. I guess i'll look around the site in abit.
* - nullifiedvoid - Jun 14, 2015
I found this vulnerability in December of 2014. It is pretty much useless unless any of you have any suggestions of how to capture the authenticyToken?
It has already been reported to Mojang. When I emailed them, they stated that there will be no payouts for vulnerability disclosures. I kind of kept it to myself for a few months hoping to find bypasses with authenticyToken. Unfortunately, I failed.
I have a few more vulnerabilities but am not sure if I want to release them.
* - SuicidalManiac - Jun 14, 2015
Pretty sure this isn't going to work, but I'll edit once I come up with something.