[Punisher]

https://blog.mybb.com/2018/07/04/mybb-1-...e-release/

- High risk: Image & URL MyCode Persistent XSS — reported by Punisher_HF
- Low risk: Non-video content embedding via Video MyCode — reported by Punisher_HF

I asked the MyBB team to link my HF profile but they didn't :( it was worth a try lmao!

I found a persistent XSS injection exploit on HackForums a few months ago, it allowed me to inject Javascript into both posts as well as signatures. Very high risk exploit, worked simply by crafting a special image tag with a URL tag inside of it causing the closing tag for the URL to break. This allowed me to load certain functions every time someone viewed one of my posts or my profile. Could have been very bad for users had someone malicious found these exploits. Omni was very quick to patch these exploits, he had them fixed within hours of reporting.
MyBB took over 2 months to release a fix after I reported it to them. Thousands of forums were vulnerable for MONTHS!
Another exploit involved malformed video tags. I was able to force users to download files from *.youtube.com, I was able to embed a chat box into posts, I was also able to embed an entire playlist and force videos to autoplay on page load even under a spoiler.

These exploits were found the same time as this thread where I found 2 other XSS exploits in HackForums (4-14-18):
https://hackforums.net/showthread.php?tid=5825006

I couldn't post about them at the time without risking a disclosure and the exploit falling into malicious hands.

I'm happy to have helped keep HackForums a safer place, and MyBB by extension.


What would YOU have done if you had found this exploit?
Should I have kept quiet and profited off the exploit, or did I do the right thing?


🤝  
👹

---

Also:
Big shout out to the Unity crew for being so bad ass!
Some of the best web application pentesters on HackForums.

[Crystallize.]

To be honest myBB team sometimes are cocky.They should have linked your profile.

Good job man and thanks for the shoutout!

[Aussie]

Well done! You do deserve recognition especially when you haven't used it for any malicious purposes or sold the method like most others would've/could've done.

[iNuke]

This is so cool! Thank you for keeping HF safe. It really makes me want to learn more about pentesting.

[Two-Ton 21]

Time to bust out BeEF. Kidding of course, that's pretty scary though.

[Chol]

This is cool . Hope omni reads this.

[JBurk]

Omni fixing it straight away was a very good decision by him. Props!

[Bossk]

props to you for not exploiting this, op could have stolen any user's account using this.

[Hyperhacktive]

Good job mate, you've done the best thing ! 🙂

[Ganja]

Great job on doing the right thing and reporting it! Nice find, keep up the good work!

[Kosmos]

You're a good person for doing the right thing. I don't know what I'd do if something happened to HF.

[mawrek]

smart kids use vbulletin forum systems

[juulstar]

Where are your "Wings"?

You deserve that award dude.

[Sir-Teabag]

That's really awesome man, good on you. Did you find them on accident or were you trying to see what you could do?

Personally I would've fucked around a little before I reported it. Like going to different MyBB forums and putting autoplay orgasm sounds on the index lol

[Punisher]

To be honest myBB team sometimes are cocky.They should have linked your profile.

Good job man and thanks for the shoutout!

It's all good, at least they acknowledged how serious the issue was and were very nice and respectful when chatting.

Well done! You do deserve recognition especially when you haven't used it for any malicious purposes or sold the method like most others would've/could've done.

Thank you, I definitely considered it, but then I thought about all the hard work has gone into MyBB and all the work people put into their forums. It's not worth ruining it for everyone else just for a bit of money.

This is so cool! Thank you for keeping HF safe. It really makes me want to learn more about pentesting.

No problem, I have spent a long time on these forums, HF is like home to me :)

Time to bust out BeEF. Kidding of course, that's pretty scary though.

Haha, not quite that easy 🤝

This is cool . Hope omni reads this.

I actually reported it to him first, he suggested I pass the bug report on to the MyBB team.

Omni fixing it straight away was a very good decision by him. Props!

He fixed it within hours of reporting it, but then I bypassed his filter a few times.
It's now completely patched.

props to you for not exploiting this, op could have stolen any user's account using this.

Absolutely, I could have wrote a worm that spread through the whole forum within hours via posts/signatures and had control over everyone online viewing any of the affected posts. Could've forced people to vacation ban themselves, could've made everyone who viewed my posts automatically give me rep, honestly the possibilities were endless. I love HackForums too much to risk getting myself banned for doing any of those things, so I decided it'd be a good idea to report it.

Good job mate, you've done the best thing ! 🙂

Thanks :)

Great job on doing the right thing and reporting it! Nice find, keep up the good work!

Glad to hear it. I'll keep looking for ways to help any way I can.

You're a good person for doing the right thing. I don't know what I'd do if something happened to HF.

That's the way I see it, this is my hangout spot, I want to keep this place safe and fun. :D

smart kids use vbulletin forum systems

It's too late to ever switch to any other forum system to run HackForums on, it's too customized at this point.

Where are your "Wings"?

You deserve that award dude.

I'm glad to have been given an award, Omni actually awarded me The Protector award for reporting 5+ exploits in a month.

That's really awesome man, good on you. Did you find them on accident or were you trying to see what you could do?

Personally I would've fucked around a little before I reported it. Like going to different MyBB forums and putting autoplay orgasm sounds on the index lol

I actually sat down one morning on a weekend, and decided; "Today I am going to find an exploit on HackForums"
I spent a good chunk of time brainstorming of methods of user input that could be targeted for exploitation.
I thought the best way to get javascript to execute on the page would be via a URL or IMG tag.
I experimented with different ways to break them and ended up finding an XSS vulnerability.

I didn't really experiment with the exploits too much simply because just by using them it would alert other hackers that a vulnerability exists, and it would be discovered and spread before the MyBB team could patch it.

I still won't share a PoC simply because I bet there are still thousands of forums that haven't installed the latest security patch.

Careful out there guys, even sites you think are 100% unhackable can have security holes that could compromise you.