+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: [XSS] NASA.gov (0day 17/09/2019) (/showthread.php?tid=6008828)
[XSS] NASA.gov (0day 17/09/2019) - Choups - Sep 17, 2019
Vulnerable domain: www.mdscc.nasa.gov
All info in: http://paulochoupina.com/notes/nasa.html
Proof-of-concept video included.
RE: [XSS] NASA.gov (0day 17/09/2019) - ~[DogiD]~ - Sep 17, 2019
Nice found.
If they are running bug bounty program, you could easily earn $10-100 with that.
But usually hackers just got thank you message, sometimes not even that.
~ DogiD
RE: [XSS] NASA.gov (0day 17/09/2019) - Choups - Sep 18, 2019
(Sep 17, 2019 11:11 PM)~[DogiD]~ Wrote: Nice found.
If they are running bug bounty program, you could easily earn $10-100 with that.
But usually hackers just got thank you message, sometimes not even that.
~ DogiD
I tried to report it like 5 times and no response..
RE: [XSS] NASA.gov (0day 17/09/2019) - ~[DogiD]~ - Sep 18, 2019
(Sep 18, 2019 03:33 AM)Choups Wrote: I tried to report it like 5 times and no response..
Typical. Dont waste you time with goverments, they arent interested of security.
Https://hackerone.com/ if you havent yet joined here. HackerOne is #1 bug bounty program site.
~ DogiD
RE: [XSS] NASA.gov (0day 17/09/2019) - Choups - Sep 18, 2019
(Sep 18, 2019 03:48 AM)~[DogiD]~ Wrote: Typical. Dont waste you time with goverments, they arent interested of security.
Https://hackerone.com/ if you havent yet joined here. HackerOne is #1 bug bounty program site.
~ DogiD
HackerOne
RE: [XSS] NASA.gov (0day 17/09/2019) - 01001 - Sep 19, 2019
It's pretty nice. I once found an SQLi vulnerability on Harvard's website. All I got was a 'Thank you' in the form of a ticket, in which they stated that your issue has been resolved!
RE: [XSS] NASA.gov (0day 17/09/2019) - Goku - Sep 19, 2019
Although this is sad they aren't obligated to give you some kind of reward.
I would only bug hunt for a company that would.
And if you really want a "reward" for a vuln than you can always go blackhat and blackmail them... Doesn't always turn out great but hey at least you get some "reward" worth your time.
RE: [XSS] NASA.gov (0day 17/09/2019) - Choups - Sep 19, 2019
(Sep 19, 2019 08:27 AM)01001 Wrote: It's pretty nice. I once found an SQLi vulnerability on Harvard's website. All I got was a 'Thank you' in the form of a ticket, in which they stated that your issue has been resolved!
I found a sqli in yahoo but the mothef_kers dont let me disclose it.
I talk about it in my website tho xD shh ^^
(Sep 19, 2019 08:32 AM)Goku Wrote: Although this is sad they aren't obligated to give you some kind of reward.
I would only bug hunt for a company that would.
And if you really want a "reward" for a vuln than you can always go blackhat and blackmail them... Doesn't always turn out great but hey at least you get some "reward" worth your time.
never done blackmail, is not my mo.
you can try to shell and root, then sell the access for good money, depending on the host.
But I quit blackhat many years ago
RE: [XSS] NASA.gov (0day 17/09/2019) - Sitrep - Sep 20, 2019
Nice find, to bad government sites just patch the bug and move on like nothing happened after your report tho...
RE: [XSS] NASA.gov (0day 17/09/2019) - FUC K YOU FBI - Sep 21, 2019
(Sep 20, 2019 07:34 PM)Sitrep Wrote: Nice find, to bad government sites just patch the bug and move on like nothing happened after your report tho...
Because with this security breach you are not able to do anything bad for them.
Its not stored XSS, you can do this basically to 20% websites who have search function.
RE: [XSS] NASA.gov (0day 17/09/2019) - Sitrep - Sep 21, 2019
(Sep 21, 2019 03:41 AM)FUC K YOU FBI Wrote: Because with this security breach you are not able to do anything bad for them.
Its not stored XSS, you can do this basically to 20% websites who have search function.
Yeah I know, probably a lot more than 20% tho 👍
RE: [XSS] NASA.gov (0day 17/09/2019) - FUC K YOU FBI - Sep 21, 2019
(Sep 21, 2019 03:42 AM)Sitrep Wrote: Yeah I know, probably a lot more than 20% tho 👍
And he calls it 0day wtf 🤣 🤣
RE: [XSS] NASA.gov (0day 17/09/2019) - SwitchOff - Sep 4, 2020
(Sep 21, 2019 03:42 AM)Sitrep Wrote: Yeah I know, probably a lot more than 20% tho 👍
-0day long before dinosaurs 😖
RE: [XSS] NASA.gov (0day 17/09/2019) - Sitrep - Sep 11, 2020
(Sep 4, 2020 10:02 PM)SwitchOff Wrote: -0day long before dinosaurs 😖
IKR 😭