[Intellectual]

Ok so I have a site that is completely expliotable. I got a 7100 email/pass list, and I think there might be some cc info ect. How do I go about telling them to fix it and make money? I dont feel like getting jailed for extortion but I dont want to hand over the data for free either. Thoughts or ideas on what to say/do?

So I sent this
"I have managed to breach your site while doing a pentest (penetration testing). I was wondering if there might be a reward for exposing your flaws and keeping your consumers safe? Everything, I repeat, everything is exploitable. I could have defaced your website and stolen every piece of data on there, but im not that kind of guy. If you need proof I can provide a screenshot of me inside of your website. A large reward would be appreciated if I told you where the error was at and how to avoid this."

[amus3d]

You've already stolen the data? I'm sure they will not give you a 'reward' for stealing their users' credit card info, usernames, emails, passwords and shit.

Good job.

[Intellectual]

Well, I took the login/pwd list so I can show as proof that they have a vulnerability.. But no I havent taken any cc, bank info, address, phone, zip ect...

[如果你能抓住我]

First of all Black Hat activity not allowed here, not even talking about.
And from my opinion there's 2 ways to make money in this situation, first inform them "That you while you were doing Pen-testing you found vulnerability etc...."
Or the other way pm me for it.

[crossera]

Well, I took the login/pwd list so I can show as proof that they have a vulnerability.. But no I haven't taken any cc, bank info, address, phone, zip ect...

They wouldn't know he has the information amu3ed ..
just tell them that they have sql vulnerability and you didn't exploited it.
And ask them if there is reward so is it worth to report it

[Intellectual]

They wouldn't know he has the information amu3ed ..
just tell them that they have sql vulnerability and you didn't exploited it.
And ask them if there is reward so is it worth to report it

Do I send them the proof that there is an exploit? Or do I just say you have one is there a reward?

[amus3d]

They wouldn't know he has the information amu3ed ..
just tell them that they have sql vulnerability and you didn't exploited it.
And ask them if there is reward so is it worth to report it

Implying that there are no logs defaultly stored.

If the vulnerabiliity was SQLi (or whatever) then it wouldn't be hard to suss out what information was taken at all, by looking through the logs.

But sure.

(I love the irony in OP's user name ;3).

[-๖ۣۜDivine-]

They wouldn't know he has the information amu3ed ..
just tell them that they have sql vulnerability and you didn't exploited it.
And ask them if there is reward so is it worth to report it

Yea, because going through the logs when they see someone threatening is something they surely won't do.

Implying that there are no logs defaultly stored.

If the vulnerabiliity was SQLi (or whatever) then it wouldn't be hard to suss out what information was taken at all, by looking through the logs.

Exactly. They can see exactly how he accomplished that, no need for PoC.

First of all Black Hat activity not allowed here, not even talking about.
And from my opinion there's 2 ways to make money in this situation, first inform them "That you while you were doing Pen-testing you found vulnerability etc...."
Or the other way pm me for it.

You are making this site look pathetic.

[Intellectual]

Ok so long story short, what do I do? I have 7100 login/passwords, thats all the data that I took. What do I do with it? Do I contact them and say "Hey I found a loophole in your system, is there a reward for telling you? Heres some proof that im not lying..."

[Phizo]

Ok so I have a site that is completely expliotable. I got a 7100 email/pass list, and I think there might be some cc info ect. How do I go about telling them to fix it and make money? I dont feel like getting jailed for extortion but I dont want to hand over the data for free either. Thoughts or ideas on what to say/do?

You may have voided your request for a reward, unless you be slightly unethical about it by neglecting to mention the fact you have access to said data.

First of all Black Hat activity not allowed here, not even talking about.
And from my opinion there's 2 ways to make money in this situation, first inform them "That you while you were doing Pen-testing you found vulnerability etc...."
Or the other way pm me for it.

Educate yourself by reading the rules; this doesn't count as "Black Hat activity."
We recommend you take the time to read the HF Help Documents section. The answer to your questions should be contained in there.

[Intellectual]

updated with what I sent, thoughts?

[amus3d]

"I have managed to breach your site while doing a pentest (penetration testing). I was wondering if there might be a reward for exposing your flaws and keeping your consumers safe? Everything, I repeat, everything is exploitable. I could have defaced your website and stolen every piece of data on there, but im not that kind of guy. If you need proof I can provide a screenshot of me inside of your website. A large reward would be appreciated if I told you where the error was at and how to avoid this."

That makes you look like you are under 14. I honestly do not believe they will take you seriously, I can barely stop laughing.

[Intellectual]

That makes you look like you are under 14. I honestly do not believe they will take you seriously, I can barely stop laughing.

Lol? Write what you would have emailed them...

[-๖ۣۜDivine-]

Lol? Write what you would have emailed them...

"Good evening.
Recently approaching your website I come to realize that there is a very explicit vulnerability within it. As a penetration tester, my duty is to keep the websites secure and I'm here to help you. Not fixing this vulnerability leaves you open to malicious hackers and puts your sites security as a risk.

If you want to keep your website safe, reply with what I'd get from this.
Good luck. -Penetration Tester" - Haxor.

[amus3d]

Lol? Write what you would have emailed them...

OKAY.

Code

[12:44:59] HaxOr - #Cut4Dyme: What about
[12:45:01] HaxOr - #Cut4Dyme: Good evening.
Recently approaching your website I come to realize that there is a very explicit vulnerability within it. As a penetration tester, my duty is to keep the websites secure and I'm here to help you. Not fixing this vulnerability leaves you open to malicious hackers and puts your sites security as a risk.

If you want to keep your website safe, reply with what I'd get from this.
Good luck. -Penetration Tester

That.