[saitto]

How did you make this alert be active when you enter the page?
I´ve been trying your method here but can't figure it out!

/s

[Z3r0C0d3]

Great job , i am sure you put effort to write the thread and find the bug

[naxes]

Was the third exploit also XSS?

(Awesome post btw)

[Tsar]

Good job with this OP! This is impressive and I also like the layout

[HiddenEyE]

very HQ to read man. good job you have put in to discover the bug

[Gee4rce]

Sorry for the late reply, i had some away time.
Thank you everyone for the kind words, glad you enjoyed the read 🤝
Spoiler (Click to View)

Such an awesome read. Thank you!

Very HQ Post. Keep it up!

Great job , i am sure you put effort to write the thread and find the bug

Good job with this OP! This is impressive and I also like the layout

very HQ to read man. good job you have put in to discover the bug

Nice work. I've used HackerOne before to check out the bounties, but I've never attempted to claim one.

I am splitten opinions about hackerone.
I have the feeling that they hold back many programs and first share them with the people leading on their list. This is not quite fair in my eyes and i usually don't participate there anymore.

How did you make this alert be active when you enter the page?
I´ve been trying your method here but can't figure it out!

Maybe you have tried it when the vulnerability was fixed already.
But basically we had this vector: www.a-url.com/asdf" onmouseover="alert(1)"//
Where as the alert was fired via HTML event handlers (<- click).

We have then stretched this link to fill the complete page with css global "style" attributes, like: onmouseover=".." style="width:100%;z-index:9999;etc.etc;".
So as the link then covered full page, a triggering of mouse move was automatically applied when visiting the page.

Note that this kind of vector was dependant from the Filtering they applied, so that does not automatically work everywhere.
Could this answer your question? If not, please get more into detail on where you got stuck.

Was the third exploit also XSS?
(Awesome post btw)

Thank you, the 3rd vulnerability was a method of stealing a users email adress by sending him a link to pornhub site.
This was involving indeed a third XSS we found, which only executed under self conditions- though we could use it to make some kind of CSRF.
We then got stuck at bypassing the Same origin Policy, which we had partially working,
but it still had some random factors,
and the fact that we didn't know if that was already reported (due to pornhubs extremly slow fixing time), we dropped on it and moved on.


Cheers, Gee.

[redlightrouter]

I just have to ask it: Why are German people so good in programming?
I know a couple of German guys who are incredible in programming and on YouTube there is this guy who explains alot on assembly, C and the vulnerabilities that come with badly written code in those 2 languages (haven't find anybody else who does that).

Correct me if I'm wrong, but you dont learn English at all in Germany, right?

[Cedric.]

This is such a neat thread. You seem like a selfdisciplined person who has put much work in both finding the vulnerability's for the site as even making a very good detailed thread about it, that even I can understand haha. It got me enthoustiastic about this whole bug bounty hunting which is still pretty undiscovered by me. I will be downloading some ebooks about it soon.

[Gee4rce]

== I am sorry this is an old thread, but i was inactive for longer and i will not leave questions unanswered, no matter how old a thread is. ==

I just have to ask it: Why are German people so good in programming?

Well almost any country has good coders, what you mean i think is why the proportion of skilled people may vary.
For germany, i suspect the following reasons: 1) germans are technologically pretty developed and have high standards,
2) after WW2, germans became more serious and disciplined, kind of a working culture. Still many of the old generations
measure their own value with how much they achieve in work life. Younger generations already are more relaxed on this.
3) Germans have english in school as main laguage (right after german). Even childs age and in Kindergarden they have
english lessons already.

...on YouTube there is this guy who explains alot on assembly, C and the vulnerabilities that come with badly written code

You are probably refering to "LiveOverflow" (hes good man 👍)

This is such a neat thread. You seem like a selfdisciplined person who has put much work in both finding the vulnerability's for the site as even making a very good detailed thread about it,  that even I can understand haha. It got me enthoustiastic about this whole bug bounty hunting which is still pretty undiscovered by me. I will be downloading some ebooks about it soon.

Thank you very much, if you are interested and enthusiastic about hacking, don't fear to dive into it!
It's a longer path and theres always something new to learn in this field, but years ago, i registered
in this forum as a beginner, just like many, and nowadays hacking has become my main Job (Pentester).
Anything is possible, with the right potion of motivation 👍

Cheers,
Gee.

[rAmUnDo]

Do you want to be well rewarded for doing what you love? If you are interested, please contact us. I need your service to test website security.

[redlightrouter]

== I am sorry this is an old thread, but i was inactive for longer and i will not leave questions unanswered, no matter how old a thread is. ==

Well almost any country has good coders, what you mean i think is why the proportion of skilled people may vary.
For germany, i suspect the following reasons: 1) germans are technologically pretty developed and have high standards,
2) after WW2, germans became more serious and disciplined, kind of a working culture. Still many of the old generations
measure their own value with how much they achieve in work life. Younger generations already are more relaxed on this.
3) Germans have english in school as main laguage (right after german). Even childs age and in Kindergarden they have
english lessons already.

You are probably refering to "LiveOverflow" (hes good man 👍)



Thank you very much, if you are interested and enthusiastic about hacking, don't fear to dive into it!
It's a longer path and theres always something new to learn in this field, but years ago, i registered
in this forum as a beginner, just like many, and nowadays hacking has become my main Job (Pentester).
Anything is possible, with the right potion of motivation 👍

Cheers,
Gee.

No way bro.. Just logged back in for the first time in years, and you replied to this thread 4 days ago.. What are the odds?

[theghostofgreen]

This is awesome. This is the type of content I like to read :D bit crap that PH isn't quick to fix this.