In April of this year I participated in a private program on HackerOne that was vulnerable to a series of IDOR that led to a complete takeover of an application. Unfortunately because this is a private program, I cannot disclose the name or company related information per their request. However I wanted to share the details on how I escalated my basic privileges from a regular “customer” account to an admin user.
On 5/5/2016 ImageMagick was assigned CVE-2016-3714 “ImageMagick Delegate Arbitrary Command Execution”. Now let’s dig to this vulnerability and how to exploit this. Having ImageMagick locally installed is advised in order to validate the POC (but not required). For this particular report, I created a file named exploit.png with the following in the “source code” to get the target’s `id`:
In June of 2015, Patrik Fehrenbach and I were able to identify a series of vulnerabilities in a few of Apple’s productivity applications: Pages, Numbers, as well as Keynote available for OS X and iOS 8.x (or older). In short, the application failed to validate the input while parsing a document.
In this blog post I will be showing a few recent vulnerabilities reported and patched by the Yahoo Security Team. In July of 2014 I was able to identify a SSRF vulnerability affecting all of Yahoo’s services that required an image processing (such as flickr and Yahoo groups). This vulnerability was patched a few weeks ago (June 2015). Now let’s get to the good stuff:
Recently I was given the opportunity to speak at NBTCon (No Big Thing Con) held at the Sales Force office in San Francisco. In my talk I explained the basics of bug bounties, some ways to maximize your revenue, and also talked about how to make a productive report. Here’s a summary of the talk (with a little bit of extra info/details) and links to the slides:
Hello everyone. Today I will be covering a very short and fast write-up in regards to two of my latest findings while participating in Yahoo Bug Bounty! First of all I want to apologize for not having any visual (pictures/videos) for this write-up. Unfortunately, I lost a lot of data due to my malfunctioning laptop.
Hello Everyone, Recently I was analyzing an XSS vulnerability on one of Yahoo’s Subdomains where I decided to also analyze the HTTP Headers. While doing so I came across the admin login page on (hk.yahoo.net), due to the fact that the search was being posted to search module from the admin panel. Well that’s not the best part!