+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Bug Bounties (https://hackforums.net/forumdisplay.php?fid=434)
+---- Thread: [Official] $1k USD in BTC Bounty for HF Exploit (/showthread.php?tid=5259373)
$1k USD in BTC Bounty for HF Exploit - Omniscient - May 4, 2016
I am now officially offering a $1000 USD in BTC as a bounty for anyone that can show me a working exploit of HF servers.
Proof of exploit will be required. I consider proof to be the current password (hashed) and salt of uid 1 (mine) from the users table. I will also require the actual exploit so it can be patched.
This will be an ongoing bounty unless I remove this thread.
I can promise that no act of retribution on my part will occur for any exposure of a weakness in HF security. HF has been exploited a few times and there isn't a single instance of me taking legal action against the person or even saying an unkind word. I've actually applauded people for getting past HF security and now I'm offering an actual bounty.
Anyone wishing to collect this bounty can contact me via PM or the contact form. This thread will be closed because I don't feel it warrants discussion.
Thank you.
EDIT: I have been asked if this means I approve of HF scanning. I do not. You do still run the risk of being closed and an IP banned. I do suggest that any exploit vulnerability checks are done manually and not done by scanning software which anyone can purchase or download. If you have a custom written script that's probably fine but too many requests or blocks is likely going to trigger a reaction from the firewall. Also, it's best you run any attempts on MyBB vanilla software first. If you come up with an exploit in the branch HF runs you should try it on HF. We currently run MyBB 1.6x at this time. You can also see if any of our custom pages have exploits.
Lastly, I'd like to say that this isn't about stopping hackers or rewarding them. It's about protecting the community. I didn't make this bounty contingent on the person being whitehat and not doing a dump and leaking it. I think that's unrealistic and I would never have a way to prove the person receiving the bounty would be honest with me. Heck, the person getting the bounty may not have even been the original person to find the exploit.
RE: $1k USD in BTC Bounty for HF Exploit - Omniscient - Mar 2, 2018
More shit talkers about HF database being leaked again. Bumping this as a reminder.
Past rumor threads:
https://hackforums.net/showthread.php?tid=4851162
https://hackforums.net/showthread.php?tid=1419820
And yeah, it could be true because MyBB 1.8x is less secure. But until it's proven to me we are indeed leak. I will consider it another rumor to trash talk HF.
RE: $1k USD in BTC Bounty for HF Exploit - Omniscient - Jun 17, 2023
Old thread, no longer relevant. See the latest thread as a sticky in this forum section.