May 4, 2016 01:01 PM
(This post was last modified: May 4, 2016 03:10 PM by Omniscient.)
I am now officially offering a $1000 USD in BTC as a bounty for anyone that can show me a working exploit of HF servers.
Proof of exploit will be required. I consider proof to be the current password (hashed) and salt of uid 1 (mine) from the users table. I will also require the actual exploit so it can be patched.
This will be an ongoing bounty unless I remove this thread.
I can promise that no act of retribution on my part will occur for any exposure of a weakness in HF security. HF has been exploited a few times and there isn't a single instance of me taking legal action against the person or even saying an unkind word. I've actually applauded people for getting past HF security and now I'm offering an actual bounty.
Anyone wishing to collect this bounty can contact me via PM or the contact form. This thread will be closed because I don't feel it warrants discussion.
Thank you.
EDIT: I have been asked if this means I approve of HF scanning. I do not. You do still run the risk of being closed and an IP banned. I do suggest that any exploit vulnerability checks are done manually and not done by scanning software which anyone can purchase or download. If you have a custom written script that's probably fine but too many requests or blocks is likely going to trigger a reaction from the firewall. Also, it's best you run any attempts on MyBB vanilla software first. If you come up with an exploit in the branch HF runs you should try it on HF. We currently run MyBB 1.6x at this time. You can also see if any of our custom pages have exploits.
Lastly, I'd like to say that this isn't about stopping hackers or rewarding them. It's about protecting the community. I didn't make this bounty contingent on the person being whitehat and not doing a dump and leaking it. I think that's unrealistic and I would never have a way to prove the person receiving the bounty would be honest with me. Heck, the person getting the bounty may not have even been the original person to find the exploit.
Proof of exploit will be required. I consider proof to be the current password (hashed) and salt of uid 1 (mine) from the users table. I will also require the actual exploit so it can be patched.
This will be an ongoing bounty unless I remove this thread.
I can promise that no act of retribution on my part will occur for any exposure of a weakness in HF security. HF has been exploited a few times and there isn't a single instance of me taking legal action against the person or even saying an unkind word. I've actually applauded people for getting past HF security and now I'm offering an actual bounty.
Anyone wishing to collect this bounty can contact me via PM or the contact form. This thread will be closed because I don't feel it warrants discussion.
Thank you.
EDIT: I have been asked if this means I approve of HF scanning. I do not. You do still run the risk of being closed and an IP banned. I do suggest that any exploit vulnerability checks are done manually and not done by scanning software which anyone can purchase or download. If you have a custom written script that's probably fine but too many requests or blocks is likely going to trigger a reaction from the firewall. Also, it's best you run any attempts on MyBB vanilla software first. If you come up with an exploit in the branch HF runs you should try it on HF. We currently run MyBB 1.6x at this time. You can also see if any of our custom pages have exploits.
Lastly, I'd like to say that this isn't about stopping hackers or rewarding them. It's about protecting the community. I didn't make this bounty contingent on the person being whitehat and not doing a dump and leaking it. I think that's unrealistic and I would never have a way to prove the person receiving the bounty would be honest with me. Heck, the person getting the bounty may not have even been the original person to find the exploit.