I’ve been hacking on the private program the entire day, mostly performing manual recon, when I came across the login function. I noticed that in the server’s response, you receive information that lets you know whether an email address already has an account created, through this I was able to find an internet test account as POC. Furthermore, I know that this vulnerability is most likely an informational, but my main goal was to figure out whether it would be a duplicate or not, letting me know how tough the competition will be considering that the scope is not a huge one. Did this let me know what I wanted to know? Yes, It did, and now I can’t wait to invest all my time into hacking this program… but, do you remember those VDP vulnerabilities I found? Yeah, I need to report those, but that will take my time away from this program I’ve found, time is important, so what I’ve decided to do is to focus on the most critical one vulnerability, which is a sensitive information disclosure, I’ve got this vulnerability on a single endpoint before, but today I found another endpoint, making it 2 vulnerabilities that I’m going to report ASAP, as soon as I’m done with this recent program.
In conclusion, I’m currently working on dealing with the VDP to make sure this critical vulnerability is attended to and the private program. I need to report these bugs first, and then I can fully focus on the private program, I tried to do that today, but I could not resist investigating these sensitive information disclosure vulnerabilities even further and that took up a lot of time.
My goal for tomorrow is to report the VDP bugs and continue my recon on the private program. Challenges keep coming my way, but I intend on moving forward. These 9 days feel like they flew by faster than I expected.
Thank you for taking the time to read through my post. Take care.
For updates — Twitter: https://twitter.com/wallotry/
To send me private program invites — HackerOne: https://hackerone.com/wallotry
