[Bossk]

OP still tryna find some exploits  🤣
Spoiler (Click to View) 👍

[Animeschoolgirl]

Props to you for doing the right thing!

[Punisher]

OP still tryna find some exploits  🤣
Spoiler (Click to View) 👍

Actually found another persistent XSS in MyBB a few days ago. Reported to MyBB and Omni yesterday. 🤝

[0riginalkillit]

OP still tryna find some exploits  🤣
Spoiler (Click to View) 👍

Hey how did you manage to see the byte history of other member
🤝

[Tʏʟᴇʀ]

Hey how did you manage to see the byte history of other member
🤝

Click the users bytes amount to pull up the popup window as if you're donating then at the bottom right corner, it says History.

[0riginalkillit]

Click the users bytes amount to pull up the popup window as if you're donating then at the bottom right corner, it says History.

It shows my history buddy not other members history
🤝

[Bossk]

Hey how did you manage to see the byte history of other member
🤝

you need a mybb exploit

[0riginalkillit]

you need a mybb exploit

OK thank you but I did no understand anything 😧 Because I have never been in web exploits
So I will begin to learn it soon 🤝

[Evanescent]

Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.

[Bossk]

Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.

disallowing it would do nothing but harm because then the blackhats would be able to find and exploit vulnerabilities, while the whitehats wont report the exploits they find in fear of being banned or whatever.

[Elitas]

Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.

It's allowed. I regularly find vulnerabilities in plugins on here and report it to Omni.

[Evanescent]

disallowing it would do nothing but harm because then the blackhats would be able to find and exploit vulnerabilities, while the whitehats wont report the exploits they find in fear of being banned or whatever.

It's allowed. I regularly find vulnerabilities in plugins on here and report it to Omni.

Alright. Sounds good, I'll give a shot when I'll be free.

[Punisher]

Are you allowed to do pentest on HF ?
Once I wanted to start then I feared that Omni may not like it and the consequences would be bad.

Only manual testing is allowed, scripts and scanning can get you banned or even closed

[Krueger]

Gj man not much to say about it besides keep us safe pls xd

[Omniscient]

Pisses me off pretty bad that we reported these very high risk vulns to MyBB and they said patch would be out in 2-3 weeks and they took 3 months. They could have alerted the community and released a simple fix.

This was a report coming from Hack Forums. They should have assumed immediately that this was going to be leaked and used maliciously. We could have pwned hundreds of MyBB forums possibly even thousands in the time they took to release the update.

Even worse, they have not successfully patched the vulnerability.

I gotta say, their MyCode parser has been fucked for many months. It's frustrating that these reports to them aren't immediately dealt with. I've complained to them about their secrecy of development. A high-risk vuln should be made public within 72 hours with a patch.

This was bullshit and I've lost confidence in the team.

Personally I think OP should release the vulns public if only to embarass the team for their lack of security. They deserve nothing less than the middle-finger for this bullshit.