This is one of the most widespread and impactful bugs I've ever found in my career. Great collab with @bsysop and @_medusa_1_
Smugglings are still out there—stay vigilant! #bugbounty@Bugcrowd
https://t.co/9bxshffknF
@codingo_@Bugcrowd I really like the freemium business model and this one is really well-thought. Like this you give customers a wide range of products to choose from and also a free "trial" without much effort from the platform.
@Hacker0x01PD @Hacker0x01 As a former triage technical lead at h1 I can tell you that Kubernetes is one of the most difficult programs there. Not many triagers will try to take the challenge and reproduce these reports, props to him/her for trying!
@Troll_13@bxmbn I remember once a hacker closed their own report after an NMI because he could not exploit an SQLi as some chars were stripped. I used the right sqlmap escape templated, it worked and I reopened the report as crit. Did that happen with you? I can't recall who was the hacker.
Story Time:
@Agornello Caesar (turtle_shell) was the one who taught me about Cache Poisoning without even asking for it, after that report my life pretty much changed, I took every advice and took advantage of it
This is how important Triagers can be in the life of a researcher
Today was my last day working at @Hacker0x01 ! It has been an incredible journey and I had the pleasure to work with an amazing team.
Much kudos to all the triagers out there, it's a hard job and they are real heroes.
Also <3 to (most of) the hackers.
turtle_shell / caesar
@naglinagli@OpenAI I actually see that a separate header with an access token is needed to hit the API endpoint, if that was the case there was no way to send the caching url to a victim because the token would not be automatically sent via the browser - I wonder what happened there
@naglinagli@OpenAI That's also a good reason why handling authentications only via cookies is a bad practice. Always use an Authorization header, you'll avoid so many issues like that.