New Record of Pakistani 14 Years Student Researcher in the field Of Web Application Security

14 Years Old , Pakistani Security Researcher Ali Hasan Ghauri  found Cross Site Scripting Vulnerability on many high profile websites. Recently Ali Hasan found and reported XSS vulnerability in one of the biggest website, ebay and its own website shopping.com

Here are some Screen Shots :

Ebay fixed the Vulnerability on both sites and credit his name in Ebay responsible Disclosure Page. This is not finished , he also found XSS Vulnerability on Myspace.com. Myspace don't reply to the Researcher. According to the Researcher , Myspace Vulnerability still exists and he reported about 15 times to the Myspace Security Team but there is no reply to the researcher .

POC is not provided by researcher because the Vulnerability still exists .

Here is Screen Shot :

This young security researcher also found an XSS vulnerability on Cisco website & reported to the Cisco Security Team.
Cisco Replied to Researcher :

Cisco fixed this XSS Vulnerability very soon But don't offer any reward for the researcher.

Here is POC:
http://newsroom.cisco.com/press-release-content?articleld=1118649%22%3E%3Cimg%20src=x%20onerror=prompt%28XSS/By/AliHasanGhauri%29%3E

In the survey of this little boy Blog , he wrote about 150+ website Vulnerability which is fixed now and this 14 Year little boy made a record (Previous record is 16 Years ) for listed on the following websites :

Gitlab
http://blog.gitlab.com/vulnerability-acknowledgements/

BarracudaLabs
http://www.barracudalabs.com/bugbounty/halloffame.html

Ebay
http://pages.ebay.com/securitycenter/ResearchersAcknowledgement.html

wizehive
http://www.wizehive.com/special_thanks.html

Redhat
https://access.redhat.com/site/articles/66234

Opera
http://my.opera.com/securitygroup/blog/2013/04/05/thanks-to-the-researchers

ConstantContact
http://www.constantcontact.com/about-constant-contact/security/report-vulnerability.jsp

According to the Researcher , he will be acknowledge in Adobe , Microsoft and At&t in Hall Of Fame because he reported the bug in these websites and they said that next month he will be listed in Hall Of Fame 

Read More..

XSS Vulnerability on Microsoft Security Response Center, found by Moroccan Researcher

A young Moroccan Security Researcher discovers XSS (Cross Site Scripting) flaw on Microsoft Security Response Center (MSRC) website. Vulnerability immediately fixed by Microsoft Security Team after reporting.

-->
POC Screen Shot:

The Security researcher told The Hackers Post that he reported XSS flaw to Microsoft. He got immediate response with appreciation and vulnerability fixed by them.

Microsoft Security Team immediately patched the XSS flaw which was reported by me. I have reported many others vulnerabilities which are not fixed yet!

[#] - Vulnerability Type: 
                           XSS (Cross Site Scripting)

[#] - Vendor homepage: 
                          http://www.microsoft.com

[#] - Tested on: 
                        Windows 7 64 bit Firefox browser  (but should have worked on other OS and browsers                      (not sure about IE))

[#] - Vulnerability Status: 
                         FIXED [Critical]

[#] - Found By: 
                        Omary Lhoussine

[#] - Vulnerable link (POC):

                 http://www.microsoft.com/security/msrc/report/disclosure.aspx#" onload="alert(document.cookie)

See Also: Amazon vulnerable to XSS flaw found by Security Researcher 

The XSS vulnerability can cause multiple damages like embedding javascript, VBScript, ActiveX, HTML, or Flash into a vulnerable dynamic page and to affect the user. A basic guide on the topic of Cross Site Scripting (XSS) can be found here.

The Security Researcher also listed on Microsoft Security Acknowledgement page .

Read More..

Pakistani Security Researcher gets 500$ Reward for Facebook Bug Bounty Program

A Pakistani Security Researcher, Former Black Hat - Haider Mehmood Qureshi, gets 500$ reward from Facebook under Facebook Bug Bounty Program for reporting HTML Injection flaw on Facebook mobile site.

Below are the details of Bug provide by the Researcher to The Hackers Post.

[#] - Vulnerability Title:
                           HTML Injection

[#] - Vendor homepage: 
                          http://m.facebook.com

[#] - Remote/Local: 
                         Remote

[#] - Tested on: 
                        Windows 7 64 bit Firefox browser  (but should have worked on other OS and browsers                      (not sure about IE))

[#] - Vulnerability Submitted:  
                        12/1/2013

[#] - Vulnerability Status: 
                         FIXED

[#] - Vulnerable  Parameter: 
                        https://m.facebook.com/survey.php?incorrect_brand&params=

Facebook mobile provides a survey to evaluate the mobile user experience as they surf facebook mobile site. Here is the survery  link: https://m.facebook.com/survey.php .

While entering the mobile phone brands , it provides a list of brands in case you didn't type the correct brand.

The list that was provided contained their HTML code inside the parameter

https://m.facebook.com/survey.php?incorrect_brand&params=[HTML code of Brands and Radio Buttons]

Remote User can add any brand Name and Radio buttons, hence allowing Remote HTML injection. It was as simple as it sounds. This could also result in adding junk entries into to database hence causing spam, because remote user can add entries and submit.

Below is the screenshot of a  portion of exact POC Researcher submitted to Facebook:

Below my the first reply from Facebook and they acknowledged the issue

below is their reply after 2 months when they fixed the issue



below is their email regarding my eligibility of bug bounty and details.

There is increase rise in black hats changing their dimensions towards bug reporting rather than exploiting them. Yesterday, we reported the youngest security researcher found XSS flaw on Amazon Site.

About Security Researcher Haider:
Haider Mehmood Qureshi is a BS Computer Sciences Student from Comsats Intitute of information technology Islamabad, He do freelancing as Penetration Tester, Started learning pentesting/hacking in 2009. Initially, he was into defacing websites just for fun, later realized to make Pentesting/Security auditing as my career. You can contact security researcher here.

Read More..