+- Hack Forums (https://hackforums.net)
+-- Forum: General Topics (https://hackforums.net/forumdisplay.php?fid=7)
+--- Forum: World (https://hackforums.net/forumdisplay.php?fid=445)
+---- Forum: Bragging Rights (https://hackforums.net/forumdisplay.php?fid=12)
+---- Thread: $300 in 15 minutes (/showthread.php?tid=6230520)
Pages: Pages
1
2
$300 in 15 minutes - Mr. Corleone - Jan 2, 2023
![[Image: f40c160e831ea52892b2cb21905b40c1.png]](https://i.gyazo.com/f40c160e831ea52892b2cb21905b40c1.png)
![[Image: 48c514dbf0611f48845d177834f47cd5.png]](https://i.gyazo.com/48c514dbf0611f48845d177834f47cd5.png)
Found an open redirect in Epicgames.
I tried escalating the severity by trying a few things like chaining it to the oauth redirect, but they secured that tightly since
that's a common thing to look for nowadays.
I find it funny how the most active programs still have low hanging fruit. Just
gotta aproach it from a different angle.
RE: $300 in 15 minutes - siddy357 - Jan 2, 2023
I understood nothing from above. Can you rinse and repeat the same thing again then good for you for finding a bug
RE: $300 in 15 minutes - Molegrips - Jan 2, 2023
Well done, was this relatively hard to do? or was it all with free tools?
RE: $300 in 15 minutes - Mr. Corleone - Jan 2, 2023
(Jan 2, 2023 05:48 AM)siddy357 Wrote: I understood nothing from above. Can you rinse and repeat the same thing again then good for you for finding a bug
My bad, I didn't explain it in a way that everyone would understand.
I can't really rinse and repeat the same bug in this manner, since every website is different.
(Jan 2, 2023 06:21 AM)Molegrips Wrote: Well done, was this relatively hard to do? or was it all with free tools?
This bug was very easy. Done with free tools.
Even if you have no background in IT, open-redirects are easy to understand within 2 minutes.
RE: $300 in 15 minutes - Duke190 - Jan 2, 2023
I wish I could understand the nonsense.
RE: $300 in 15 minutes - ailo - Jan 2, 2023
well done im trying to get into this as well seems lucrative.
RE: $300 in 15 minutes - Mr. Corleone - Jan 2, 2023
(Jan 2, 2023 04:20 PM)ailo Wrote: well done im trying to get into this as well seems lucrative.
Don't.
Most low hanging fruits are easily found by others already.
Thousands of people automating scripts and such to find them.
It takes too much time to learn and actually finding bugs.
The people who you see getting 10k+ bugs usually spend months
just reading code from a single application and understand how it works inside out, to the point
they understand it better than the developers in many cases.
Unless you're really fanatic about it or already have a lot of programming/web security experience,
don't bother.
RE: $300 in 15 minutes - PhireTalker - Jan 3, 2023
I have to agree, the learning curve to bug hunting has you constantly learning the process without actually hunting for bugs. By the time you actually know how to hunt for bugs, there's an uphill battle to keep learning for the most current bugs since the bugs you learned about has already been found.
RE: $300 in 15 minutes - web0m - Jan 4, 2023
Nice one, really surprising that you were able to find something that simple.
Also, a lot of these programs open redirects are excluded.
The chances of you finding an open redirect that potentially thousands of people already looked for, and they also pay for open redirects, are super slim.
You should buy a lotto coupon
RE: $300 in 15 minutes - ihysmhf - Jan 4, 2023
Well done lmao. Way over my heas but well done.
RE: $300 in 15 minutes - Mr. Corleone - Jan 5, 2023
(Jan 4, 2023 11:05 AM)t0xi Wrote: Nice one, really surprising that you were able to find something that simple.
Also, a lot of these programs open redirects are excluded.
The chances of you finding an open redirect that potentially thousands of people already looked for, and they also pay for open redirects, are super slim.
You should buy a lotto coupon
I found the unvalidated redirect on an out of scope domain.
Chained it to a validated redirect on an in-scope domain.
Hence why no one found it before me. But indeed, open redirects are extremely rare on a program of this size.
RE: $300 in 15 minutes - web0m - Jan 5, 2023
(Jan 5, 2023 07:19 AM)Mr. Corleone Wrote: I found the unvalidated redirect on an out of scope domain.
Chained it to a validated redirect on an in-scope domain.
Hence why no one found it before me. But indeed, open redirects are extremely rare on a program of this size.
Impressive that they still would pay you, when it's out of scope.
Nice find anyways!
RE: $300 in 15 minutes - The Pact - Jan 6, 2023
(Jan 2, 2023 04:03 PM)Mr. Corleone Wrote: My bad, I didn't explain it in a way that everyone would understand.
I can't really rinse and repeat the same bug in this manner, since every website is different.
This bug was very easy. Done with free tools.
Even if you have no background in IT, open-redirects are easy to understand within 2 minutes.
So was this like White Hat. So Epic Games offers a bounty if you find a bug? Please excuse my ignorance if I'm getting it all wrong.
RE: $300 in 15 minutes - Mr. Corleone - Jan 7, 2023
(Jan 6, 2023 11:22 PM)The Pact Wrote: So was this like White Hat. So Epic Games offers a bounty if you find a bug? Please excuse my ignorance if I'm getting it all wrong.
Yup! That's exactly right. You're allowed to test epic games in-scope assets.
It's okay, not many people heard of bug bounties outside the IT-world.
RE: $300 in 15 minutes - The Pact - Jan 7, 2023
(Jan 7, 2023 05:09 AM)Mr. Corleone Wrote: Yup! That's exactly right. You're allowed to test epic games in-scope assets.
It's okay, not many people heard of bug bounties outside the IT-world.
HaHa I'm not and have never been in IT at all so I expect to be dumb around here but I guess I figured it out from being on HF long enough.