Find bugs in my new software [$3 each bug]

Status
Not open for further replies.
Ok sorry then. Anyway, I think it is a good idea to block 1-word passwords

Don't know if it is exactly wrong but I could register and log in simultaneously in the same browser with two different accounts of different types (one seller and other buyer).
 
Last edited:
Advertise on BHW
Shirko said:
Although I don't quite like the current website, sounds like a good idea to me!

this is what I've found so far:
Code: 
http://serpclix.com/users/register/
    > still accessible when already logged in

http://serpclix.com/users/login/
    > still accessible when already logged in

http://serpclix.com/payments/order/create/
    > when form throws validation errors, 'click count' and 'tier' field values are lost / not restored

http://serpclix.com/payments/order/checkout/<order_id>/
    > not properly user protected - sensitive information accessible to any user account
    > should be updated accordingly when order is paid

http://serpclix.com/payments/order/canceled/<order_id>/
    > not properly user protected - sensitive information accessible to any user account
    > CSRF vulnerable - no CSRF token validation
    > I was apparently able to cancel order #2 (which is not even mine) - output reported "order cancelled" and it was no longer accessible from /payments/order/checkout/2/

http://serpclix.com/payments/order/delete/<order_id>/
    > not properly user protected - sensitive information accessible to any user account
    > CSRF vulnerable - no CSRF token validation
    > I was apparently able to delete order #5 (which is not even mine) - output attempted to load payments/order_confirm_delete.html template
    > template does not exist (payments/order_confirm_delete.html)

http://serpclix.com/payments/order/thankyou/
    > still accessible when there's no order placed

http://serpclix.com/payments/paypal/
    > not really a bug but it could contain sensitive info in the near future - looks like IPN so no big deal though

http://serpclix.com/payments/order/list/
    > there should be a link to /payments/order/checkout/<order_id>/ to send the payment. otherwise there's no way to come back to the payment gateway once exited

all the best my friend
Click to expand...


MASSIVE THANK-YOU. PM me your PayPal address.
 
Web Echo said:
Why do you want to pay him? You didn't pay me for that info. I had already told you about those links.
Click to expand...

He denied the money, he didn't want it.

I don't recall you reporting:

http://serpclix.com/payments/order/checkout/<order_id>/
> not properly user protected - sensitive information accessible to any user account

And the 2 other URLs about CSRF token validation

If you did report those 2-3, PM me and I can pay you instead.
 
I had already told you about this and also gave you suggestion to stop showing unnecessary information to all. I also told you to write your debug info to file. See:-

Web Echo said:
You have a serious problem with your site itself.

See: http://serpclix.com/robots.txt
Click to expand...

The above was a hint as I was posting in open forum. But you didn't get it and said that you aren't worried about robots.txt file. So I replied:


Web Echo said:
It's not just about robots.txt file. If you try anything say http://serpclix.com/anycrapfilename then it will show that error with details. It's NOT good. Trust me, you are giving unnecessary information to all anonymous visitors of your site.
Click to expand...

I had also provided few links in PM. Please check your PMs.


User @dannyvriens advise you to turned off debug mode. You refused. So I gave suggestion to write debug info into file. As I can see that you haven't followed that too.


Here is how any hacker can find all those URLs:

Step 1:

Visit http://serpclix.com/robots.txt

There you will know about ^payments/

Step 2:

Visit http://serpclix.com/payments/

There you will get all the following information related to payments

^payments/ ^order/create/$ [name='payments_create_order']
^payments/ ^order/list/$ [name='payments_order_list']
^payments/ ^order/checkout/(?P<order_id>\d+)/$ [name='payments_checkout']
^payments/ ^order/canceled/(?P<order_id>\d+)/$ [name='payments_order_cancel']
^payments/ ^order/thankyou/ [name='payments_order_thankyou']
^payments/ ^order/delete/(?P<order_id>\d+)/$ [name='payments_order_delete']
^payments/ ^price-serialzier/$ [name='payments_tier_serializer']
^payments/ ^seller/home/$ [name='payments_seller_home']
^payments/ seller/addon-download-guide/$ [name='payments_addon_download_guide']
^payments/ seller/addon-download/$ [name='payments_addon_download']
^payments/ ^paypal/


Now a hacker know what he needs to do further ;)


BTW, I don't want your $3. If you had my client then I would have charged at least $250 for all the information and suggestions I gave.

My last advice: Always listen what others are telling you and think over it before refusing their advice. You never know which small suggestion may save you from big trouble!

Best of luck for your project. :)
 
Web Echo said:
User @dannyvriens advise you to turned off debug mode. You refused. So I gave suggestion to write debug info into file. As I can see that you haven't followed that too.
Click to expand...

Didn't mean to come off "refusing" but more, we are working on it. There are some strange Apache issues we're facing when turning it off.

But yeah, when it going into production, it will def be off.
 
Update: Debug mode now turned off. Any other errors, please send them forward!
 
How about this whenever I try to log-in using the extension.

No response from server. Please try again in a few moments
 
imGrej said:
How about this whenever I try to log-in using the extension.

No response from server. Please try again in a few moments
Click to expand...

This should be fixed, are you getting it at this moment?
 
Anymore bugs?? Send them in. EVERYTHING should be fixed.
 
Our Firefox extension has just passed Mozilla inspection and we are now verified! Updates will be easier now.
 
Hey guys, I think all the bugs are fixed. Can anyone find one?
 
Will post here as I see things wrong.

I signed up as a seller.

On clicking 'Click here to order Clicks' in the home page, I am taken to

http://serpclix.com/users/login/?next=/payments/order/create/

Where I am stuck in a login loop within the dashboard. ( Already logged in). I guess thats only for buyers. Make sure you give it a check.

Will post again as I see something. I actually wanted to signup as a buyer and try cracking the payment part. Let me check it out now.
 
Ok, another related one.

I have a seller account, and I am logged into it. On clicking 'Click Here to order Clicks' I get to a login loop where I am already logged into account 1. But from this login box, I can login to account 2 if its buyers account.

Poor session handling I guess? Havent looked what is happening to the cookies yet.
 
About the payment part, well, I could tweak the html codes,adjust the cost per item to say 1 cent, and get the right quantity at low cost. It would then depend upon how you are dealing with the IPN post back. Your IPN postback URL is publicly visible in the html, which is 'http://serpclix.com/payments/paypal/'. Well, thats the only way if you have so many IPNs based checkout sites in a single account, else you can set it in the account itself.

The IPN listener being public, make sure you check the IPN is made from Paypal itself, or there is a chance for people to bruteforce using simulators.

I didnt try simulation part or doing a biased payment,(Setting item price to 1 cent instead of your rates) and see if I get the credits. But I guess you should do a check.

Good luck mate.
 
Any follow up? Did you get a chance to fix the bug I pointed out about login? I thought you were in a spree killing bugs and thought you monitor this thread regularly.
 
Repulsor said:
Will post here as I see things wrong.

I signed up as a seller.

On clicking 'Click here to order Clicks' in the home page, I am taken to

http://serpclix.com/users/login/?next=/payments/order/create/

Where I am stuck in a login loop within the dashboard. ( Already logged in). I guess thats only for buyers. Make sure you give it a check.

Will post again as I see something. I actually wanted to signup as a buyer and try cracking the payment part. Let me check it out now.
Click to expand...

Thanks for this one. Good find. PM me your PayPal. I'll check out the other ones shortly.
 
Repulsor said:
About the payment part, well, I could tweak the html codes,adjust the cost per item to say 1 cent, and get the right quantity at low cost. It would then depend upon how you are dealing with the IPN post back. Your IPN postback URL is publicly visible in the html, which is 'http://serpclix.com/payments/paypal/'. Well, thats the only way if you have so many IPNs based checkout sites in a single account, else you can set it in the account itself.

The IPN listener being public, make sure you check the IPN is made from Paypal itself, or there is a chance for people to bruteforce using simulators.

I didnt try simulation part or doing a biased payment,(Setting item price to 1 cent instead of your rates) and see if I get the credits. But I guess you should do a check.

Good luck mate.
Click to expand...

PayPal protects all this. Go ahead and try to break it. I'll refund your money that you send. Just send me your PayPal ID once done and I'll refund the order.
 
Advertise on BHW
Status
Not open for further replies.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top