Jun 3, 2018 03:15 PM (This post was last modified: Jun 3, 2018 03:31 PM by Nyx.)
I see no reason to not post this as the exploit has been completely patched.
So my friend Sam and I were talking on discord the other day when I told him I was gambling on Bustabit, (if you did not already know, Bustabit is a BTC gambling platform where you place a bet and it multiplies whatever you cash out on) and we were just about to purchase some BTC when I said, "Hey Sam, do you think this could be Vuln to XSS? He said, "I doubt it." We decided to look anyways. Within ten minutes we found an XSS using the websites click here to continue feature. It turned out that it was vuln to javascript URI.
We could use this to trick users into clicking any link (The exploit was all onsite) taking the users session allowing us to log into their account.
Here is the demo video we created and sent to Daniel (The current owner of Bustabit)
Jun 3, 2018 03:40 PM (This post was last modified: Jun 3, 2018 03:41 PM by Nyx.)
(Jun 3, 2018 03:38 PM)Hyperhacktive Wrote: Good job to both of you !
Did you get a reward from it ?
Daniel said he would message us within 48 hours after talking with his team and he also said, and I quote, "We do not have a bug bounty program but this is definitely something worthy of a bounty" that was late Friday night.
Jun 3, 2018 04:00 PM (This post was last modified: Jun 3, 2018 04:00 PM by Nyx.)
(Jun 3, 2018 03:56 PM)Hailstone Wrote: So this allowed you to log into anyones account? For your sake I hope you get a big reward because anyone would else would rob people blind
It essentially allowed us to login to anyone's account that clicked a link we gave them.
If someone were to click the link it would just freeze and not go to the site we gave them.
You could just post the link in chat and then whoever was dumb enough to click it, believe me when I say this; there would be lots of people who would have fallen for it, we would have been able to login to their account without their email and password. We could have set up an onsite fishing panel where the user had to sign in on our link with his email and password and then it would send the email and password to the logs file we had on our web server but we chose not to.
(Jun 3, 2018 04:00 PM)Nyx Wrote: It essentially allowed us to login to anyone's account that clicked a link we gave them.
If someone were to click the link it would just freeze and not go to the site we gave them.
You could just post the link in chat and then whoever was dumb enough to click it, believe me when I say this; there would be lots of people who would have fallen for it, we would have been able to login to their account without their email and password. We could have set up an onsite fishing panel where the user had to sign in on our link with his email and password and then it would send the email and password to the logs file we had on our web server but we chose not to.
I'm curious to know why you reported this when hypothetically you could have stolen a lot of BTC? Either way good for you for reporting it 🤝
(Jun 3, 2018 04:03 PM)Bluffer Wrote: Very cool video. Just want to let you know at about 3:52 seconds or 3:53 seconds or something around there, a password shows before it's blured.
Jun 3, 2018 04:19 PM (This post was last modified: Jun 3, 2018 04:23 PM by Nyx.)
(Jun 3, 2018 04:03 PM)Bluffer Wrote: Very cool video. Just want to let you know at about 3:52 seconds or 3:53 seconds or something around there, a password shows before it's blured.
Yeah, that was for "generate a new"
Good looks though!
(Jun 3, 2018 04:11 PM)Hyperhacktive Wrote: Nice catch, you should update your password mate
That isn't my current, that was the generate a new one.
You'd need my current to make that my new one.
(Jun 3, 2018 04:17 PM)Sir-Teabag Wrote: Damn bruh how fucking fast can he type?
I type around 140-150 WPM's depending on if I'm going in.
He types around 125.
I believe we both learned to type fast from playing Runescape WAY back in the day haha (World 2 Falador park before the grand exchange was a thing / selling cowhides in al kharid)
