malsploit Posted December 28, 2013 Report Share Posted December 28, 2013 Acum cateva zile am gasit niste vulnerabilitati intr-un site de plati online. Initial am descoperit ca site-ul respectiv isi ia codurile captcha dintr-un fisier txt care continea ~1k de cuvinte random. Am mers putin mai departe si am gasit un director /fileadmin/ care continea extrem de multe fisiere si directoare. Acolo am descoperit si un director log/ care continea logurile de acces. In acest director era si un fisier intranet.log in care erau intregistrate logurile de acces din reteaua intranet. Am mai gasit si un alt director /intranet care continea documente interne ale companiei, strategii de marketing, date personale ale angajatilor etc. Am dat si peste niste xss-uri, un lfi. Am descoperit si un formular unde puteai urca anumite tipuri de fisiere. Nu am cautat mai multe la acel moment.Am incercat sa le cer celor care se ocupa de twitter si de facebook-ul companiei un e-mail la care sa pot raporta vulnerabilitatile. Mi-au spus sa raportez la info@*.com Am trimis mail acolo cu un raport de 2 pagini si 2 zile nu a raspuns nimeni. Am publicat pe blogul personal un video cenzurat si le-am trimis postarea printr-un mesaj pe facebook. In 20 de minute am avut vreo 300 de vizualizari pe blog de la niste ip-uri care apartin companiei. Am fost contactat de CISOul lor si mi-a cerut un numar de telefon. I-am spus ca nu vorbesc foarte bine engleza si ca ar trebui sa vorbim pe e-mail. I-am explicat unde sunt vulnerabilitatile si cum sa le repare. Eu ii spuneam si in cateva secunde era reparat Chiar era un sentiment placut. Dupa ce Au fost reparate, primesc urmatorul mesaj:Dear Alexandru,a big thank you for providing us all your findings and your great corporation.Even we don’t have a bounty program, this situation was new for us and we have decided to reward your research. We kindly ask you to delete all sensitive information (e.g. intranet data, youtube video, ..) to these vulnerabilities in order to protect our employees and customers. Your research showed us that we need a better contact point and structure process to deal with such situation and we will address this in the future.Can you please send us a confirmation considering the sensitive information?Regards,christophDupa ce am sters video-ul, am primit alt e-mail:Dear Alexandru,Thank you for effort.As promised, we want to reward your research and provide you with 1.000 € Good luck!Regards,christophA doua zi dimineata aveam banii in cont. Data viitoare cand raportati ceva, scrieti un raport care sa arate frumos, fiti amabili, incercati sa luati legatura cu cei care se ocupa de securitate si sigur veti avea de castigat 1 Quote Link to comment Share on other sites More sharing options...
Silviu Posted December 28, 2013 Report Share Posted December 28, 2013 Felicitari! Puteai sa dai de altii mai jegosi care sa te dea pe mana negrilor, dar se pare ca ai dat de oameni ok. Quote Link to comment Share on other sites More sharing options...
GarryOne Posted December 28, 2013 Report Share Posted December 28, 2013 Asta e cel mai bun exemplu cum ar trebui sa fie tratata o situatia de genul de catre ambele parti, cum ar trebui practicat Security Researching-ul. Quote Link to comment Share on other sites More sharing options...
StoNe- Posted December 28, 2013 Report Share Posted December 28, 2013 (edited) Felicitari, in primul rand. In al doilea, poti posta structura raportului? Sau criteriile de care tii cont in momentul in care faci un raport de genul.Ar fi util pentru multi (cel putin pentru mine, ar fi). Merci. Edited December 28, 2013 by StoNe- Quote Link to comment Share on other sites More sharing options...
malsploit Posted December 28, 2013 Author Report Share Posted December 28, 2013 Felicitari, in primul rand. In al doilea, poti posta structura raportului? Sau criteriile de care tii cont in momentul care faci un raport de genul.Ar fi util pentru multi (cel putin pentru mine, ar fi). Merci.Nu e vorba de o anumita structura. Pur si simplu depinde de la caz la caz. Principala lor problema era faptul ca nu era server-ul corect configurat si se facea directory-listing. Asa am putut sa gasesc si xss si lfi. Le-am explicat cum am gasit vulnerabilitatile, am dramatizat putin impactul asupra clientilor, le-am vorbit chestii generale despre xss, lfi etc Quote Link to comment Share on other sites More sharing options...
dekeeu Posted December 28, 2013 Report Share Posted December 28, 2013 Felicitari, in primul rand. In al doilea, poti posta structura raportului? Sau criteriile de care tii cont in momentul in care faci un raport de genul.Ar fi util pentru multi (cel putin pentru mine, ar fi). Merci.Ideea e sa fi dragut, amabil si sa nu CERI tu recompensa cum am mai vazut la unii pampalici de pe forum , nu dau nume(strongB??) . Quote Link to comment Share on other sites More sharing options...
sleed Posted December 28, 2013 Report Share Posted December 28, 2013 Felicitari!! off @ In ce ai scris raportul ? Quote Link to comment Share on other sites More sharing options...
StoNe- Posted December 28, 2013 Report Share Posted December 28, 2013 Nu e vorba de o anumita structura. Pur si simplu depinde de la caz la caz. Principala lor problema era faptul ca nu era server-ul corect configurat si se facea directory-listing. Asa am putut sa gasesc si xss si lfi. Le-am explicat cum am gasit vulnerabilitatile, am dramatizat putin impactul asupra clientilor, le-am vorbit chestii generale despre xss, lfi etcAm inteles. Merci de raspuns si felicitari inca o data. E bine de stiut, pentru ca se acumuleaza experienta. Quote Link to comment Share on other sites More sharing options...
malsploit Posted December 28, 2013 Author Report Share Posted December 28, 2013 Felicitari!! off @ In ce ai scris raportul ?Multumesc! Raport e mult spus L-am scris intr-un editor de text si l-am exportat in pdf. Dar nu asta e important. Quote Link to comment Share on other sites More sharing options...
tudor13mn13 Posted December 28, 2013 Report Share Posted December 28, 2013 Felicitari! Se pare ca sunt si firme de treaba care dau rewarduri calumea.. Quote Link to comment Share on other sites More sharing options...
Byte-ul Posted December 28, 2013 Report Share Posted December 28, 2013 Poti posta si cateva emailuri trimise de tine?Multumesc Quote Link to comment Share on other sites More sharing options...
malsploit Posted December 28, 2013 Author Report Share Posted December 28, 2013 Quote Link to comment Share on other sites More sharing options...
sicilianul Posted December 28, 2013 Report Share Posted December 28, 2013 Felicitari inca o data! Si uite asa ai bani de sarbatori Quote Link to comment Share on other sites More sharing options...
Cuddlybunny Posted December 28, 2013 Report Share Posted December 28, 2013 (edited) felicitari !! Edited December 28, 2013 by Cuddlybunny Quote Link to comment Share on other sites More sharing options...
Jimmy20 Posted December 28, 2013 Report Share Posted December 28, 2013 Felicit?ri omule ! Quote Link to comment Share on other sites More sharing options...
maresky Posted December 28, 2013 Report Share Posted December 28, 2013 Felicitari, perseverenta. Quote Link to comment Share on other sites More sharing options...
malsploit Posted February 24, 2014 Author Report Share Posted February 24, 2014 Povestea a continuat La vreo 2 saptamani, am primit un email de la CISO in care mi se propunea sa testez periodic securitatea site-urilor administrate de catre companie. Le-am zis ca sunt interesat si joi m-am intalnit cu CISO-ul lor la bucuresti si am semnat un contract de consultanta. Am posibilitatea sa fac orice fel de teste, atata timp cat nu pun in pericol infrastructura. Am primit acces la reteaua interna a companiei si chiar am posibilitatea sa fac SE pe angajati. Mi s-a permis sa public ce vulnerabilitati gasesc numai pe blog-ul meu, pe care l-am specificat in contract.Inainte de data de 5 a fiecarei luni trebuie sa fac un raport in care sa le spun ce am gasit si pana pe data de 10 primesc o anumita suma de bani. 1 Quote Link to comment Share on other sites More sharing options...
alexandruth Posted February 24, 2014 Report Share Posted February 24, 2014 Felicitari omule! Am si eu o intrebare... Am gasit niste vulnerabilitati la doua site-uri mari de media din Romania si vreau sa ii ajut sa le corecteze, doar ca mi-e frica sa le spun. As vrea sa fac un mail asemanator cu al tau, adica sa le arat unde e vulnerabilitatea si modul in care acestia o pot corecta. Sunt sanse sa imi bata mascatii la usa? E legal sa cauti asa vulnerabilitati? Multumesc anticipat! Quote Link to comment Share on other sites More sharing options...
Gio33 Posted February 24, 2014 Report Share Posted February 24, 2014 Felicitari! Quote Link to comment Share on other sites More sharing options...
iHouse Posted February 24, 2014 Report Share Posted February 24, 2014 Numai eu primesc raspunsuri gen :Dear XXX,thank you.will be fixed soonGreetings : XXX Staff ON@: Bravo, daca ai lasa ca un model de CV cum sa raportam o vulnerabilitate ar fi tare, tine-o tot asa. Quote Link to comment Share on other sites More sharing options...
Menta Posted February 24, 2014 Report Share Posted February 24, 2014 Good luck hate ! Quote Link to comment Share on other sites More sharing options...
fadwow Posted February 25, 2014 Report Share Posted February 25, 2014 Felicitari! Quote Link to comment Share on other sites More sharing options...
neox Posted February 25, 2014 Report Share Posted February 25, 2014 Felicitari hate.me Acuma se nasc visele pe rst Quote Link to comment Share on other sites More sharing options...
