Traffic service & campaign optimization ◆ Spoof Call and Spoof SMS set any caller ◆ ZexoCard: no-KYC virtual crypto cards ◆ Private Crypter - Unique Private Stubs ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › [Vulnerability] New Minecraft.net XSS Vulnerability

New Reply 

[Vulnerability] New Minecraft.net XSS Vulnerability
Ɲorman Bates
Ɲorman Bates Offline
..............................
***
HF Ub3r
Posts:
549
Threads:
139
Credibility:
000
Popularity:
45
βytes:
β 0
Game XP:
0
Jun 13, 2015 02:21 PM (This post was last modified: Jun 14, 2015 03:08 PM by Ɲorman Bates.)




This exploit was found by this awesome guy.
(Didn't know he had HF, but he's been on my skype for awhile lol)
Fractal
Fractal Away
[closed@HF:]
Posts:
158
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 13, 2015 02:22 PM
Nice find man. 🤝
ThePenumbra
Guest
 
Jun 13, 2015 02:23 PM
Good job on finding that. Would report it to them if I were you.
Ɲorman Bates
Ɲorman Bates Offline
..............................
***
HF Ub3r
Posts:
549
Threads:
139
Credibility:
000
Popularity:
45
βytes:
β 0
Game XP:
0
Jun 13, 2015 03:14 PM
(Jun 13, 2015 02:23 PM)ThePenumbra Wrote:  Good job on finding that. Would report it to them if I were you.

Don't want to report it, want to see if anyone can do anything with this
HaxOr❤
HaxOr❤ Offline
INTRA
***
HF Ub3r
Posts:
4,952
Threads:
209
Credibility:
000
Popularity:
955
βytes:
β 100.5
Game XP:
0
Jun 13, 2015 03:18 PM
It's POST XSS mate. Pretty much useless.
ThePenumbra
Guest
 
Jun 13, 2015 03:20 PM
(Jun 13, 2015 03:18 PM)HaxOr❤ Wrote:  It's POST XSS mate. Pretty much useless.

Sorry Haxxy baby, but are you dumb o.o?
I can make a link which on click auto-submits a POST request.
OP, got skype/xmpp?
If yes, PM me it.
Fractal
Fractal Away
[closed@HF:]
Posts:
158
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 13, 2015 03:21 PM
Harder to use, yes, but it's more dangerous as you don't see it in the requested URL. Either way this should be reported to Mojang, maybe you'll get some money for finding the exploit.
ThePenumbra
Guest
 
Jun 13, 2015 03:23 PM
(Jun 13, 2015 03:21 PM)Fractal Wrote:  Harder to use, yes, but it's more dangerous as you don't see it in the requested URL. Either way this should be reported to Mojang, maybe you'll get some money for finding the exploit.

Why is it harder to use?
It's really easy.
Make a form, use js to auto-submit it.
Ez fucking pz.
Fractal
Fractal Away
[closed@HF:]
Posts:
158
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jun 13, 2015 03:25 PM
(Jun 13, 2015 03:23 PM)ThePenumbra Wrote:  Why is it harder to use?
It's really easy.
Make a form, use js to auto-submit it.
Ez fucking pz.

Exactly, JavaScript/HTML is required to make it work. Hence why it's harder to use on people, or implement. I totally agree with you, it's not useless.
SIM-1241186
SIM-1241186 Offline
[bin@HF:]
*
Registered
Posts:
1,946
Threads:
104
Credibility:
100
Popularity:
3
βytes:
β 0
Game XP:
0
Jun 13, 2015 07:49 PM
(Jun 13, 2015 03:20 PM)ThePenumbra Wrote:  Sorry Haxxy baby, but are you dumb o.o?
I can make a link which on click auto-submits a POST request.
OP, got skype/xmpp?
If yes, PM me it.

You did not just call HaxOr❤ dumb 🤫
Angel-sama❤️
Guest
 
Jun 13, 2015 07:51 PM
Wow what a great find. I've been trying to do something with it so far. :)
Ɲorman Bates
Ɲorman Bates Offline
..............................
***
HF Ub3r
Posts:
549
Threads:
139
Credibility:
000
Popularity:
45
βytes:
β 0
Game XP:
0
Jun 13, 2015 11:45 PM
(Jun 13, 2015 07:51 PM)Angel-sama❤️ Wrote:  Wow what a great find. I've been trying to do something with it so far. :)

No one done anything with it yet? Waiting for a big hax0r to get something done
ThePenumbra
Guest
 
Jun 14, 2015 12:22 AM
(Jun 13, 2015 11:47 PM)Yani Wrote:  That form has CSRF protection and your auto-submit thing would never work.

Didn't notice that. I guess i'll look around the site in abit.
nullifiedvoid
nullifiedvoid Away
[user@HF:]
**
HF l33t
Posts:
249
Threads:
28
Credibility:
000
Popularity:
104
βytes:
β 0
Game XP:
0
Jun 14, 2015 02:38 PM (This post was last modified: Jun 14, 2015 02:50 PM by nullifiedvoid.)
I found this vulnerability in December of 2014. It is pretty much useless unless any of you have any suggestions of how to capture the authenticyToken?

It has already been reported to Mojang. When I emailed them, they stated that there will be no payouts for vulnerability disclosures. I kind of kept it to myself for a few months hoping to find bypasses with authenticyToken. Unfortunately, I failed.

I have a few more vulnerabilities but am not sure if I want to release them.
SuicidalManiac
SuicidalManiac Away
[n00b@HF:]
*
HF l33t
Posts:
46
Threads:
4
Credibility:
000
Popularity:
5
βytes:
β 0
Game XP:
0
Jun 14, 2015 06:36 PM
Pretty sure this isn't going to work, but I'll edit once I come up with something.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by deetexOct 14, 2024 12:46 PM 6 243 Oct 14, 2024 12:46 PM
Last Post: deetex
by bad_andyagentDec 27, 2023 11:17 PM 1 258 Dec 27, 2023 11:17 PM
Last Post: niteesh
by Gee4rceApr 19, 2021 06:47 AM 26 4,056 Apr 19, 2021 06:47 AM
Last Post: theghostofgreen