Ok so I have a site that is completely expliotable. I got a 7100 email/pass list, and I think there might be some cc info ect. How do I go about telling them to fix it and make money? I dont feel like getting jailed for extortion but I dont want to hand over the data for free either. Thoughts or ideas on what to say/do?
So I sent this
"I have managed to breach your site while doing a pentest (penetration testing). I was wondering if there might be a reward for exposing your flaws and keeping your consumers safe? Everything, I repeat, everything is exploitable. I could have defaced your website and stolen every piece of data on there, but im not that kind of guy. If you need proof I can provide a screenshot of me inside of your website. A large reward would be appreciated if I told you where the error was at and how to avoid this."
You've already stolen the data? I'm sure they will not give you a 'reward' for stealing their users' credit card info, usernames, emails, passwords and shit.
Good job.
Well, I took the login/pwd list so I can show as proof that they have a vulnerability.. But no I havent taken any cc, bank info, address, phone, zip ect...
First of all Black Hat activity not allowed here, not even talking about.
And from my opinion there's 2 ways to make money in this situation, first inform them "That you while you were doing Pen-testing you found vulnerability etc...."
Or the other way pm me for it.
(Mar 31, 2013 03:36 AM)crossera Wrote: They wouldn't know he has the information amu3ed ..
just tell them that they have sql vulnerability and you didn't exploited it.
And ask them if there is reward so is it worth to report it
Do I send them the proof that there is an exploit? Or do I just say you have one is there a reward?
(Mar 31, 2013 03:36 AM)crossera Wrote: They wouldn't know he has the information amu3ed ..
just tell them that they have sql vulnerability and you didn't exploited it.
And ask them if there is reward so is it worth to report it
Implying that there are no logs defaultly stored.
If the vulnerabiliity was SQLi (or whatever) then it wouldn't be hard to suss out what information was taken at all, by looking through the logs.
But sure.
(I love the irony in OP's user name ;3).
(Mar 31, 2013 03:36 AM)crossera Wrote: They wouldn't know he has the information amu3ed ..
just tell them that they have sql vulnerability and you didn't exploited it.
And ask them if there is reward so is it worth to report it
Yea, because going through the logs when they see someone threatening is something they surely won't do.
(Mar 31, 2013 03:43 AM)amus3d Wrote: Implying that there are no logs defaultly stored.
If the vulnerabiliity was SQLi (or whatever) then it wouldn't be hard to suss out what information was taken at all, by looking through the logs.
Exactly. They can see exactly how he accomplished that, no need for PoC.
(Mar 31, 2013 03:35 AM)如果你能抓住我 Wrote: First of all Black Hat activity not allowed here, not even talking about.
And from my opinion there's 2 ways to make money in this situation, first inform them "That you while you were doing Pen-testing you found vulnerability etc...."
Or the other way pm me for it.
You are making this site look pathetic.
Ok so long story short, what do I do? I have 7100 login/passwords, thats all the data that I took. What do I do with it? Do I contact them and say "Hey I found a loophole in your system, is there a reward for telling you? Heres some proof that im not lying..."
updated with what I sent, thoughts?
(Mar 31, 2013 03:28 AM)Intellectual Wrote: "I have managed to breach your site while doing a pentest (penetration testing). I was wondering if there might be a reward for exposing your flaws and keeping your consumers safe? Everything, I repeat, everything is exploitable. I could have defaced your website and stolen every piece of data on there, but im not that kind of guy. If you need proof I can provide a screenshot of me inside of your website. A large reward would be appreciated if I told you where the error was at and how to avoid this."
That makes you look like you are under 14. I honestly do not believe they will take you seriously, I can barely stop laughing.
(Mar 31, 2013 04:43 AM)amus3d Wrote: That makes you look like you are under 14. I honestly do not believe they will take you seriously, I can barely stop laughing.
Lol? Write what you would have emailed them...
(Mar 31, 2013 04:44 AM)Intellectual Wrote: Lol? Write what you would have emailed them...
"Good evening.
Recently approaching your website I come to realize that there is a very explicit vulnerability within it. As a penetration tester, my duty is to keep the websites secure and I'm here to help you. Not fixing this vulnerability leaves you open to malicious hackers and puts your sites security as a risk.
If you want to keep your website safe, reply with what I'd get from this.
Good luck. -Penetration Tester" - Haxor.
(Mar 31, 2013 04:44 AM)Intellectual Wrote: Lol? Write what you would have emailed them...
OKAY.
Code [12:44:59] HaxOr - #Cut4Dyme: What about
[12:45:01] HaxOr - #Cut4Dyme: Good evening.
Recently approaching your website I come to realize that there is a very explicit vulnerability within it. As a penetration tester, my duty is to keep the websites secure and I'm here to help you. Not fixing this vulnerability leaves you open to malicious hackers and puts your sites security as a risk.
If you want to keep your website safe, reply with what I'd get from this.
Good luck. -Penetration Tester
That.
(Mar 31, 2013 04:45 AM)amus3d Wrote: OKAY.
Code [12:44:59] HaxOr - #Cut4Dyme: What about
[12:45:01] HaxOr - #Cut4Dyme: Good evening.
Recently approaching your website I come to realize that there is a very explicit vulnerability within it. As a penetration tester, my duty is to keep the websites secure and I'm here to help you. Not fixing this vulnerability leaves you open to malicious hackers and puts your sites security as a risk.
If you want to keep your website safe, reply with what I'd get from this.
Good luck. -Penetration Tester
That.
You didnt write it :P
OT: Copied, pasted and sent :D
(Mar 31, 2013 04:49 AM)Intellectual Wrote: You didnt write it :P
OT: Copied, pasted and sent :D
Wait, you've sent them an email, then sent another one - about the same vulnerability?
You're not too good at this 'white hat thing' are you.
Maybe try this:
Code [12:51:54] HaxOr - #Cut4Dyme: Hello,
recently after discovering your website I came to realise that there is a very explicit vulnerability within it.
As a penetration tester, I feel it is my duty is to keep websites secure and I'm here to assist you in accomplishing that.
Failure to fix this vulnerability leaves you open to malicious hackers and puts not only your site's, but your users' security at risk as well.
If you wish to further secure your site, I'd like to know your reward policy regarding these types of vulnerability reports as soon as possible as a reply to this email.
Regards,
Penetration Tester.
or
Code Good evening.
Recently approaching your website I came to realize that there is an explicit vulnerability concerning it.
I'd like to notify you of its existance in order not to expose the website to any breaches that may occur.
Failure to fix this vulnerability leaves you open to blackhat hackers and puts not only your site's, but
your users' security at risk as well.
Good luck. -Penetration Tester
|
