Anvilpoint CyberOps - Hacker for Hire ◆ Spoof Call and Spoof SMS set any caller ◆ ProxiesFood: Unlimited Residential Proxy ◆ Cheap KYC Verifications & Openups ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking › [XSS] NASA.gov (0day 17/09/2019)

New Reply 

[XSS] NASA.gov (0day 17/09/2019)
Choups
Choups Offline
[closed@HF:]
Posts:
27
Threads:
10
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 17, 2019 01:57 PM (This post was last modified: Sep 17, 2019 02:29 PM by Choups.)
Vulnerable domain: www.mdscc.nasa.gov

All info in: http://paulochoupina.com/notes/nasa.html

Proof-of-concept video included.
~[DogiD]~
~[DogiD]~ Offline
The Labracadabrador ...
***
HF Ub3r
Posts:
1,146
Threads:
38
Credibility:
300
Popularity:
1,357
βytes:
β 55.28
Game XP:
433,231
Sep 17, 2019 11:11 PM (This post was last modified: Sep 17, 2019 11:13 PM by ~[DogiD]~.)
Nice found.
If they are running bug bounty program, you could easily earn $10-100 with that.

But usually hackers just got thank you message, sometimes not even that.

~ DogiD
~[ XSS Tutorial for beginners ]~

[Image: vBDPw4l.png]
Choups
Choups Offline
[closed@HF:]
Posts:
27
Threads:
10
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 18, 2019 03:33 AM
(Sep 17, 2019 11:11 PM)~[DogiD]~ Wrote:  Nice found.
If they are running bug bounty program, you could easily earn $10-100 with that.

But usually hackers just got thank you message, sometimes not even that.

~ DogiD

I tried to report it like 5 times and no response..
~[DogiD]~
~[DogiD]~ Offline
The Labracadabrador ...
***
HF Ub3r
Posts:
1,146
Threads:
38
Credibility:
300
Popularity:
1,357
βytes:
β 55.28
Game XP:
433,231
Sep 18, 2019 03:48 AM
(Sep 18, 2019 03:33 AM)Choups Wrote:  I tried to report it like 5 times and no response..

Typical. Dont waste you time with goverments, they arent interested of security.

Https://hackerone.com/ if you havent yet joined here. HackerOne is #1 bug bounty program site.

~ DogiD
~[ XSS Tutorial for beginners ]~

[Image: vBDPw4l.png]
Choups
Choups Offline
[closed@HF:]
Posts:
27
Threads:
10
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 18, 2019 12:58 PM
(Sep 18, 2019 03:48 AM)~[DogiD]~ Wrote:  Typical. Dont waste you time with goverments, they arent interested of security.

Https://hackerone.com/ if you havent yet joined here. HackerOne is #1 bug bounty program site.

~ DogiD

HackerOne
01001
01001 Offline
https://vanshield.io -Cybersecurity
***
HF V3ndors
Posts:
4,809
Threads:
45
Credibility:
23001
Popularity:
1,779
βytes:
β 22.3
Game XP:
87,983
Sep 19, 2019 08:27 AM
It's pretty nice. I once found an SQLi vulnerability on Harvard's website. All I got was a 'Thank you' in the form of a ticket, in which they stated that your issue has been resolved!
[Image: rH1OGR3.gif]
Goku
Goku Offline
Give me your energy
****
HF Ub3r
Posts:
8,156
Threads:
118
Credibility:
5800
Popularity:
2,113
βytes:
β 184.04
Game XP:
123,376
Sep 19, 2019 08:32 AM (This post was last modified: Sep 19, 2019 08:33 AM by Goku.)
Although this is sad they aren't obligated to give you some kind of reward.
I would only bug hunt for a company that would.

And if you really want a "reward" for a vuln than you can always go blackhat and blackmail them... Doesn't always turn out great but hey at least you get some "reward" worth your time.
[Image: AEMUV3u.gif]
Choups
Choups Offline
[closed@HF:]
Posts:
27
Threads:
10
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Sep 19, 2019 11:05 AM (This post was last modified: Sep 19, 2019 11:07 AM by Choups.)
(Sep 19, 2019 08:27 AM)01001 Wrote:  It's pretty nice. I once found an SQLi vulnerability on Harvard's website. All I got was a 'Thank you' in the form of a ticket, in which they stated that your issue has been resolved!

I found a sqli in yahoo but the mothef_kers dont let me disclose it.
I talk about it in my website tho xD shh ^^
(Sep 19, 2019 08:32 AM)Goku Wrote:  Although this is sad they aren't obligated to give you some kind of reward.
I would only bug hunt for a company that would.

And if you really want a "reward" for a vuln than you can always go blackhat and blackmail them... Doesn't always turn out great but hey at least you get some "reward" worth your time.

never done blackmail, is not my mo.
you can try to shell and root, then sell the access for good money, depending on the host.

But I quit blackhat many years ago
Sitrep
Sitrep Offline
Security Nerd
***
HF l33t
Posts:
683
Threads:
25
Credibility:
100
Popularity:
183
βytes:
β 0
Game XP:
0
Sep 20, 2019 07:34 PM
Nice find, to bad government sites just patch the bug and move on like nothing happened after your report tho...
FUC K YOU FBI
Guest
 
Sep 21, 2019 03:41 AM
(Sep 20, 2019 07:34 PM)Sitrep Wrote:  Nice find, to bad government sites just patch the bug and move on like nothing happened after your report tho...

Because with this security breach you are not able to do anything bad for them.
Its not stored XSS, you can do this basically to 20% websites who have search function.
Sitrep
Sitrep Offline
Security Nerd
***
HF l33t
Posts:
683
Threads:
25
Credibility:
100
Popularity:
183
βytes:
β 0
Game XP:
0
Sep 21, 2019 03:42 AM
(Sep 21, 2019 03:41 AM)FUC K YOU FBI Wrote:  Because with this security breach you are not able to do anything bad for them.
Its not stored XSS, you can do this basically to 20% websites who have search function.

Yeah I know, probably a lot more than 20% tho 👍
FUC K YOU FBI
Guest
 
Sep 21, 2019 06:25 AM
(Sep 21, 2019 03:42 AM)Sitrep Wrote:  Yeah I know, probably a lot more than 20% tho  👍

And he calls it 0day wtf 🤣 🤣
SwitchOff
SwitchOff Offline
[n00b@HF:]
*
Registered
Posts:
27
Threads:
0
Credibility:
100
Popularity:
1
βytes:
β 0
Game XP:
0
Sep 4, 2020 10:02 PM
(Sep 21, 2019 03:42 AM)Sitrep Wrote:  Yeah I know, probably a lot more than 20% tho  👍

-0day long before dinosaurs 😖
Sitrep
Sitrep Offline
Security Nerd
***
HF l33t
Posts:
683
Threads:
25
Credibility:
100
Popularity:
183
βytes:
β 0
Game XP:
0
Sep 11, 2020 12:58 PM
(Sep 4, 2020 10:02 PM)SwitchOff Wrote:  -0day long before dinosaurs 😖

IKR 😭
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by Gee4rceApr 19, 2021 06:47 AM 26 4,058 Apr 19, 2021 06:47 AM
Last Post: theghostofgreen
by longwenzhangDec 12, 2019 07:54 AM 0 229 Dec 12, 2019 07:54 AM
Last Post: longwenzhang
by frank3nstienJul 18, 2019 10:38 PM 2 325 Jul 18, 2019 10:38 PM
Last Post: frank3nstien