A guy got $40,000 for breaching Bing's SERP

flprocess · Mar 30, 2023

So this guy found a vulnerability in Azure, which led him to manipulate Bing's SERP (called "Bing Trivia") and even get all users private keys with XSS attack.

After he reported it to Microsoft, they awarded him $40,000, which he say he will donate.

https://twitter.com/x/status/1641146508639600646

https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration

Ramazan · Mar 30, 2023

clark123 · Mar 30, 2023

wow sick!! crazy door just left open to admin panel

!
He should have awarded at least 400K!!! for that

flprocess · Mar 31, 2023

clark123 said:
wow sick!! crazy door just left open to admin panel !
He should have awarded at least 400K!!! for that

I wouldn't mind just the $40k

Maybe he could sell it here in bhw "rank #1 in bing guarantee"

nohupt · Mar 31, 2023

effin badass. also shows how, even in 2023, microsoft is still always open to exploits. he probably could have made more money going black hat with it.

xLuckySzx · Mar 31, 2023

He should have been awarded more, considering the severity

terrycody · Mar 31, 2023

xLuckySzx said:
He should have been awarded more, considering the severity

On the contrary, bug hunting does not work like that, many big ones will only get small peanuts money, this is the industry looks like.

Btw, this is by far the 2nd biggest SERP loopholes if I remember right, 1st one is about sitemap hijacking several years ago, also can guarantee massive ranking overnight and can easily make millions if he/she knows how to utilize it. The dude also reported the bug to Google and get merely couple of thousands.

RoboTech · Mar 31, 2023

40k isn't shit. He could've literally make millions with this!!

flprocess · Apr 1, 2023

RoboTech said:
40k isn't shit. He could've literally make millions with this!!

True, but I guess he is more into cyber than im

RoboTech · Apr 1, 2023

flprocess said:
True, but I guess he is more into cyber than im

His plan was, instead of taking advantage of the vulnerability let's:

1- Get validation from Microsoft and the geek community
2- Donate the money so you get validation from the rest of the world

What a weirdo.

A guy got $40,000 for breaching Bing's SERP

flprocess

Supreme Member

Ramazan

Regular Member

clark123

Regular Member

flprocess

Supreme Member

nohupt

Power Member

xLuckySzx

Newbie

terrycody

Elite Member

RoboTech

Senior Member

flprocess

Supreme Member

RoboTech

Senior Member

Main Menu

Marketplace

Making Money

BlackHat World