🛒 View HF's Premium Marketplace ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ Private Crypter - Unique Private Stubs ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums General Topics World Bragging Rights › I found a vulnerability on Audi's website.

New Reply 

I found a vulnerability on Audi's website.
bar0n
bar0n Offline
[n00b@HF:]
*
Registered
Posts:
78
Threads:
11
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 10, 2017 11:59 AM
Hey HF,
You probably never heard of me but maybe you will more in the future. I've recently starting experimenting with different wide-known vulnerabilities such as SQL and XSS.

I wanted to test my knowledge and did a Google search on websites that have a search? parameter in their url and found the american website of Audi, the car company. After a while I was able to get an alert from it.

Spoiler (Click to View)

Do you think I should report this bug?
RUMRUN
RUMRUN Offline
4e 79 7a 6f
***
HF Ub3r
Posts:
2,219
Threads:
116
Credibility:
500
Popularity:
122
βytes:
β 0
Game XP:
0
Sep 10, 2017 12:00 PM
Don't worry, I'm reporting it right now
[Image: iMC2aQP.png]
Nachfolger
Nachfolger Offline
Certified gay communist amoeba
*
Registered
Posts:
11,370
Threads:
152
Credibility:
2000
Popularity:
3,370
βytes:
β 0.73
Game XP:
255,394
Sep 10, 2017 12:02 PM
I don't understand how this could compromise security of their site? Maybe someone could tell me.

Also, rip your reward, someone is gonna report it before you now.

Je t'aime
[Image: fpZ5a5g.png]

(Apr 22, 2022 04:39 PM)-Scrub Wrote:  Jokes on you, I'm not smart enough to know what he's talking about.
Punisher
Punisher Offline
%00
**********
H4CK3R$
Posts:
3,921
Threads:
292
Credibility:
500
Popularity:
810
βytes:
β 34,743.12
Game XP:
111
Sep 10, 2017 12:11 PM
If you could force a password change by embedding a form into a search url then you could potentially change other members passwords by simply sending them a link. Depends on whether they use tokens to verify input.

Could be a big deal, if it was used correctly. Should probably report it, maybe you'll get a free car?
[Image: member.php?action=register&referrer=163196]
bar0n
bar0n Offline
[n00b@HF:]
*
Registered
Posts:
78
Threads:
11
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 10, 2017 12:16 PM (This post was last modified: Sep 10, 2017 12:17 PM by bar0n.)
(Sep 10, 2017 12:02 PM)Nachfolger Wrote:  I don't understand how this could compromise security of their site? Maybe someone could tell me.

Also, rip your reward, someone is gonna report it before you now.

It might not even have to be with their site, because they have users what I could do is make the website redirect to a cloned version of it and when the users order a car, they will send the money to me. Phishing kind of. You could steal credentials in non-httponly cookies or make user download malware, log keystrokes etc.

The interesting thing is that user will complain to audi and not me if this attack is properly executed with good security measures taken such as socks5,vpn,rdp, useragent, mac,

(Sep 10, 2017 12:11 PM)Punisher Wrote:  If you could force a password change by embedding a form into a search url then you could potentially change other members passwords by simply sending them a link. Depends on whether they use tokens to verify input.

Could be a big deal, if it was used correctly. Should probably report it, maybe you'll get a free car?

I'll try to accomplish that! But yeah reporting is a good idea. Will do tomorrow.

(Sep 10, 2017 12:00 PM)RUMRUN Wrote:  Don't worry, I'm reporting it right now

Good luck sniper rifle.
.Satellite.
.Satellite. Offline
[closed@HF:]
Posts:
2,338
Threads:
431
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 10, 2017 12:36 PM
If you find something like this, why the hell would you post on HF about it before you report it. Companies often give rewards for this stuff.
wit
wit Offline
life moves fast
***
HF Ub3r
Posts:
3,068
Threads:
228
Credibility:
700
Popularity:
737
βytes:
β 0
Game XP:
424
Sep 10, 2017 12:38 PM
I'll purchase this exploit off you.
!
.Satellite.
.Satellite. Offline
[closed@HF:]
Posts:
2,338
Threads:
431
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 10, 2017 12:40 PM
(Sep 10, 2017 12:38 PM)wit Wrote:  I'll purchase this exploit off you.

Why would you do that when someone clearly is going to report it already. That would be a waste of money.
wit
wit Offline
life moves fast
***
HF Ub3r
Posts:
3,068
Threads:
228
Credibility:
700
Popularity:
737
βytes:
β 0
Game XP:
424
Sep 10, 2017 12:40 PM
(Sep 10, 2017 12:40 PM).Satellite. Wrote:  Why would you do that when someone clearly is going to report it already. That would be a waste of money.

Didn't even see that first guy reported it already, fuck
!
falkenburry
falkenburry Offline
[closed@HF:]
Posts:
676
Threads:
30
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 10, 2017 12:41 PM
(Sep 10, 2017 12:40 PM).Satellite. Wrote:  Why would you do that when someone clearly is going to report it already. That would be a waste of money.
To get more money. moron
bar0n
bar0n Offline
[n00b@HF:]
*
Registered
Posts:
78
Threads:
11
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Sep 10, 2017 12:55 PM (This post was last modified: Sep 10, 2017 12:59 PM by bar0n.)
(Sep 10, 2017 12:36 PM).Satellite. Wrote:  If you find something like this, why the hell would you post on HF about it before you report it. Companies often give rewards for this stuff.

Don't worry I've though about this, there are two XSS vulnerabilities on this website. The user who wants to report it will have to send Audi query to prove the bug is there. Audi will not spend 3 days like I did finding a bug that possibly doesn't even exist.

Plus user doesn't even have query of the bug.

(Sep 10, 2017 12:36 PM).Satellite. Wrote:  If you find something like this, why the hell would you post on HF about it before you report it. Companies often give rewards for this stuff.

I know, but I want some presence here on HF and I have started working on HackerOne and will report bugs there but then some times it is fun just showing off some work here too.
PlzDecideInMyFavor
PlzDecideInMyFavor Offline
[closed@HF:]
Posts:
6
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 11, 2017 03:31 AM
He probably mitm his own connection and played html popup
gg
HuntedCS
HuntedCS Offline
[closed@HF:]
Posts:
1,828
Threads:
132
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 11, 2017 03:34 AM
Why does your image redirect to an ad on my iPhone telling me my phone is 28.3% damaged from adult websites. 🤣
PlzDecideInMyFavor
PlzDecideInMyFavor Offline
[closed@HF:]
Posts:
6
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 11, 2017 03:37 AM
(Sep 11, 2017 03:34 AM)HuntedCS Wrote:  Why does your image redirect to an ad on my iPhone telling me my phone is 28.3% damaged from adult websites. 🤣

lol your phone is infected with adware
its a gyazo link works fine for me
Nebo
Nebo Offline
[closed@HF:]
Posts:
1,586
Threads:
116
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 11, 2017 03:40 AM
Gyazo has ads... It's a shitty service.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by NateDec 29, 2019 06:14 AM 13 464 Dec 29, 2019 06:14 AM
Last Post: Voxi
by Blockchain*Jun 7, 2018 02:15 PM 11 759 Jun 7, 2018 02:15 PM
Last Post: BlαckHat
by M3m3Destr0y3rSep 2, 2017 10:16 PM 11 417 Sep 2, 2017 10:16 PM
Last Post: OGHash