Cheap KYC Verifications & Openups ◆ Anvilpoint CyberOps - Hacker for Hire ◆ Traffic service & campaign optimization ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums General Topics World Bragging Rights › $300 in 15 minutes

New Reply 

$300 in 15 minutes
Mr. Corleone
Mr. Corleone Away
No me, just title.
****
HF Ub3r
Posts:
6,756
Threads:
290
Credibility:
1500
Popularity:
1,730
βytes:
β 111.41
Game XP:
10,197
Jan 2, 2023 05:42 AM (This post was last modified: Jan 2, 2023 04:36 PM by Mr. Corleone.)
[Image: f40c160e831ea52892b2cb21905b40c1.png]
[Image: 48c514dbf0611f48845d177834f47cd5.png]

Found an open redirect in Epicgames.

I tried escalating the severity by trying a few things like chaining it to the oauth redirect, but they secured that tightly since
that's a common thing to look for nowadays.

I find it funny how the most active programs still have low hanging fruit. Just
gotta aproach it from a different angle.
siddy357
siddy357 Offline
[ssh@HF:]
****
HF Ub3r
Posts:
5,615
Threads:
37
Credibility:
4800
Popularity:
1,128
βytes:
β 10.18
Game XP:
181,034
Jan 2, 2023 05:48 AM
I understood nothing from above. Can you rinse and repeat the same thing again then good for you for finding a bug
Molegrips
Molegrips Offline
[user@HF:]
*
Registered
Posts:
150
Threads:
2
Credibility:
200
Popularity:
33
βytes:
β 5
Game XP:
0
Jan 2, 2023 06:21 AM
Well done, was this relatively hard to do? or was it all with free tools?
Mr. Corleone
Mr. Corleone Away
No me, just title.
****
HF Ub3r
Posts:
6,756
Threads:
290
Credibility:
1500
Popularity:
1,730
βytes:
β 111.41
Game XP:
10,197
Jan 2, 2023 04:03 PM
(Jan 2, 2023 05:48 AM)siddy357 Wrote:  I understood nothing from above. Can you rinse and repeat the same thing again then good for you for finding a bug

My bad, I didn't explain it in a way that everyone would understand.
I can't really rinse and repeat the same bug in this manner, since every website is different.

(Jan 2, 2023 06:21 AM)Molegrips Wrote:  Well done, was this relatively hard to do? or was it all with free tools?

This bug was very easy. Done with free tools.
Even if you have no background in IT, open-redirects are easy to understand within 2 minutes.
Duke190
Duke190 Offline
[n00b@HF:]
*
Registered
Posts:
3
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jan 2, 2023 04:17 PM
I wish I could understand the nonsense.
ailo
ailo Offline
Give your best,leave the rest toGod
*******
Gamblers
Posts:
3,548
Threads:
256
Credibility:
6300
Popularity:
3,392
βytes:
β 4.22
Game XP:
3,683
Jan 2, 2023 04:20 PM
well done im trying to get into this as well seems lucrative.
Buy my signature space
Mr. Corleone
Mr. Corleone Away
No me, just title.
****
HF Ub3r
Posts:
6,756
Threads:
290
Credibility:
1500
Popularity:
1,730
βytes:
β 111.41
Game XP:
10,197
Jan 2, 2023 04:37 PM
(Jan 2, 2023 04:20 PM)ailo Wrote:  well done im trying to get into this as well seems lucrative.

Don't.

Most low hanging fruits are easily found by others already.
Thousands of people automating scripts and such to find them.

It takes too much time to learn and actually finding bugs.

The people who you see getting 10k+ bugs usually spend months
just reading code from a single application and understand how it works inside out, to the point
they understand it better than the developers in many cases.

Unless you're really fanatic about it or already have a lot of programming/web security experience,
don't bother.
PhireTalker
PhireTalker Offline
[n00b@HF:]
*
Registered
Posts:
8
Threads:
0
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
5
Jan 3, 2023 09:56 AM
I have to agree, the learning curve to bug hunting has you constantly learning the process without actually hunting for bugs. By the time you actually know how to hunt for bugs, there's an uphill battle to keep learning for the most current bugs since the bugs you learned about has already been found.
web0m
web0m Offline
Absolutely nerd
*
Registered
Posts:
120
Threads:
12
Credibility:
000
Popularity:
55
βytes:
β 0
Game XP:
0
Jan 4, 2023 11:05 AM
Nice one, really surprising that you were able to find something that simple.
Also, a lot of these programs open redirects are excluded.

The chances of you finding an open redirect that potentially thousands of people already looked for, and they also pay for open redirects, are super slim.

You should buy a lotto coupon
ihysmhf
ihysmhf Offline
[closed@HF:]
Posts:
2
Threads:
0
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jan 4, 2023 06:58 PM
Well done lmao. Way over my heas but well done.
Mr. Corleone
Mr. Corleone Away
No me, just title.
****
HF Ub3r
Posts:
6,756
Threads:
290
Credibility:
1500
Popularity:
1,730
βytes:
β 111.41
Game XP:
10,197
Jan 5, 2023 07:19 AM
(Jan 4, 2023 11:05 AM)web0m Wrote:  Nice one, really surprising that you were able to find something that simple.
Also, a lot of these programs open redirects are excluded.

The chances of you finding an open redirect that potentially thousands of people already looked for, and they also pay for open redirects, are super slim.

You should buy a lotto coupon

I found the unvalidated redirect on an out of scope domain.
Chained it to a validated redirect on an in-scope domain.

Hence why no one found it before me. But indeed, open redirects are extremely rare on a program of this size.
web0m
web0m Offline
Absolutely nerd
*
Registered
Posts:
120
Threads:
12
Credibility:
000
Popularity:
55
βytes:
β 0
Game XP:
0
Jan 5, 2023 07:20 AM
(Jan 5, 2023 07:19 AM)Mr. Corleone Wrote:  I found the unvalidated redirect on an out of scope domain.
Chained it to a validated redirect on an in-scope domain.

Hence why no one found it before me. But indeed, open redirects are extremely rare on a program of this size.

Impressive that they still would pay you, when it's out of scope.
Nice find anyways!
The Pact
The Pact Offline
As Morning Steals Upon the Night.
*****
Staff
Posts:
12,993
Threads:
1,113
Credibility:
1600
Popularity:
2,544
βytes:
β 6,402.2
Game XP:
0
Jan 6, 2023 11:22 PM (This post was last modified: Jan 6, 2023 11:23 PM by The Pact.)
(Jan 2, 2023 04:03 PM)Mr. Corleone Wrote:  My bad, I didn't explain it in a way that everyone would understand.
I can't really rinse and repeat the same bug in this manner, since every website is different.


This bug was very easy. Done with free tools.
Even if you have no background in IT, open-redirects are easy to understand within 2 minutes.

So was this like White Hat. So Epic Games offers a bounty if you find a bug? Please excuse my ignorance if I'm getting it all wrong.
Mr. Corleone
Mr. Corleone Away
No me, just title.
****
HF Ub3r
Posts:
6,756
Threads:
290
Credibility:
1500
Popularity:
1,730
βytes:
β 111.41
Game XP:
10,197
Jan 7, 2023 05:09 AM
(Jan 6, 2023 11:22 PM)The Pact Wrote:  So was this like White Hat. So Epic Games offers a bounty if you find a bug? Please excuse my ignorance if I'm getting it all wrong.

Yup! That's exactly right. You're allowed to test epic games in-scope assets.
It's okay, not many people heard of bug bounties outside the IT-world.
The Pact
The Pact Offline
As Morning Steals Upon the Night.
*****
Staff
Posts:
12,993
Threads:
1,113
Credibility:
1600
Popularity:
2,544
βytes:
β 6,402.2
Game XP:
0
Jan 7, 2023 05:26 AM (This post was last modified: Jan 7, 2023 05:26 AM by The Pact.)
(Jan 7, 2023 05:09 AM)Mr. Corleone Wrote:  Yup! That's exactly right. You're allowed to test epic games in-scope assets.
It's okay, not many people heard of bug bounties outside the IT-world.

HaHa I'm not and have never been in IT at all so I expect to be dumb around here but I guess I figured it out from being on HF long enough.
Next Oldest | Next Newest
New Reply 


Possibly Related Threads...
Thread / Author Replies Views Last Post
by SpagyricistAug 30, 2019 06:11 AM 27 1,447 Aug 30, 2019 06:11 AM
Last Post: ScriptingVirtuoso
by MilfMay 30, 2018 07:52 AM 62 1,748 May 30, 2018 07:52 AM
Last Post: Bossk
by Mr.Peanut IIJun 25, 2017 05:52 AM 53 1,406 Jun 25, 2017 05:52 AM
Last Post: Tobya