Find bugs in my new software [$3 each bug]

Status
Not open for further replies.
Where's my money ?
I'll look for more if my paypal agrees with me :P
 
Advertise on BHW
BUG 1:
I registered yesterday, and today I forgot my password. lol. Where is the "Forgot Password?/Reset Password" link on login page?
Ref.:
Code: 
[URL]http://serpclix.com/users/login/?next=/index/[/URL]

BUG 2:
Also, I never received any verification code after registering on the site... Was I actually registered? (Login name: srb888)


In all humbleness, I think that you need to change your coder/s first...
 
Last edited:
macdonjo3 said:
Not too worried about robots.txt right now.

Knowing the framework we use is not really a bug. It's not even a secret. It's hardly a security vulnerability.
Click to expand...

It's not just about robots.txt file. If you try anything say http://serpclix.com/anycrapfilename then it will show that error with details. It's NOT good. Trust me, you are giving unnecessary information to all anonymous visitors of your site.

Knowing the framework is definitely NOT a bug. But unless you own that framework (I think you own it), it's better to hide it as far as possible, especially it's internal structure etc is discussed all over the internet. But as you are the owner (my guess), I understand if you want to show off it's use :)
 
Please please please turn off your debug mode, each error on your page is easy pick for hackers to get some good information.

I send you a pm with more information
 
Web Echo said:
It's not just about robots.txt file. If you try anything say http://serpclix.com/anycrapfilename then it will show that error with details. It's NOT good. Trust me, you are giving unnecessary information to all anonymous visitors of your site.

Knowing the framework is definitely NOT a bug. But unless you own that framework (I think you own it), it's better to hide it as far as possible, especially it's internal structure etc is discussed all over the internet. But as you are the owner (my guess), I understand if you want to show off it's use :)
Click to expand...

dannyvriens said:
Please please please turn off your debug mode, each error on your page is easy pick for hackers to get some good information.

I send you a pm with more information
Click to expand...

We are not turning debug off until we actually have all the errors. Once we go into production mode, we will.
 
I found a bug that could save you thousands. Going to send you a PM.
 
Hey man, I can't PM you so I'll say it here.
I registered one account with username "Testing123" and password "1". Only one number, no letters. Then I logged out and tried to log in with the same account but with a different password. I could login one time with the password "q". After logout again I couldn't relogin with the password "q", only with the original "1".
 
Last edited:
macdonjo3 said:
We are not turning debug off until we actually have all the errors. Once we go into production mode, we will.
Click to expand...

It should be like this. But my point is those debug information should not be available to everyone. Have you think about writing that info into a debug log file instead of showing it in open? IMO, you should.
 
Please delete my account on your site. Username: WebEcho

And consider adding 'Delete Account' feature.
 
DrJnr said:
Hey man, I can't PM you so I'll say it here.
I registered one account with username "Testing123" and password "1". Only one number, no letters. Then I logged out and tried to log in with the same account but with a different password. I could login one time with the password "q". After logout again I couldn't relogin with the password "q", only with the original "1".
Click to expand...

I've still got to look into this. We have a bunch of bugs ahead of you, but we will check it out.
 
Looks like there is some issues at your end.
Firefox Addon cant login to the creds while in the browser I can login easily.
Also you should take a look at your Div class='controls' as after registration its saving paypal email instead of the username.

Cheers
 
Although I don't quite like the current website, sounds like a good idea to me!

this is what I've found so far:
Code: 
http://serpclix.com/users/register/
    > still accessible when already logged in

http://serpclix.com/users/login/
    > still accessible when already logged in

http://serpclix.com/payments/order/create/
    > when form throws validation errors, 'click count' and 'tier' field values are lost / not restored

http://serpclix.com/payments/order/checkout/<order_id>/
    > not properly user protected - sensitive information accessible to any user account
    > should be updated accordingly when order is paid

http://serpclix.com/payments/order/canceled/<order_id>/
    > not properly user protected - sensitive information accessible to any user account
    > CSRF vulnerable - no CSRF token validation
    > I was apparently able to cancel order #2 (which is not even mine) - output reported "order cancelled" and it was no longer accessible from /payments/order/checkout/2/

http://serpclix.com/payments/order/delete/<order_id>/
    > not properly user protected - sensitive information accessible to any user account
    > CSRF vulnerable - no CSRF token validation
    > I was apparently able to delete order #5 (which is not even mine) - output attempted to load payments/order_confirm_delete.html template
    > template does not exist (payments/order_confirm_delete.html)

http://serpclix.com/payments/order/thankyou/
    > still accessible when there's no order placed

http://serpclix.com/payments/paypal/
    > not really a bug but it could contain sensitive info in the near future - looks like IPN so no big deal though

http://serpclix.com/payments/order/list/
    > there should be a link to /payments/order/checkout/<order_id>/ to send the payment. otherwise there's no way to come back to the payment gateway once exited

all the best my friend
 
Advertise on BHW
Status
Not open for further replies.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top