I found a flaw, should I report it???

CoyoteAssassin · Jul 23, 2011

I've been trying for months to get contact information for members of a particular website. Today, I somewhat found a way in.

I found out that if I create an account and during the registration process, alter the URL, I can assign myself as the primary contact of that company. To confirm that it was legit, I did it a couple more times. Now, my (fake) email address and (fake) name are associated with this company.

However, this still did not reveal the email address.

So, I continued at it. Finally, I was able to alter the URL so that it would not only assign me to a company but allow me to view their employee list (and email addresses).

Having said that, I could (in theory) assign myself to all records, grab the email addresses and run. That would be a huge mess for the system and I do not want that for the.

So, is it OK (legally) for me to tell them that in exchange for their membership list that I will reveal the flaw?

Thoughts? What would you do?

reinie · Jul 23, 2011

Whatever you do, try to exploit it so no-one is negatively influenced or left with less... if not possible, walk away

CoyoteAssassin · Jul 23, 2011

reinie said:
Whatever you do, try to exploit it so no-one is negatively influenced or left with less... if not possible, walk away

Yeah, I'm trying to leave as little footprint as possible although I know there will still be some. Though they will see errors, they will never know how they were generated.

I can access Phone, Fax, Name, Address, Website, Company but not email. Blah!

This is a huge list. So close, but yet so far. May just take the URL and hope that WHOIS will give at least some info.

CoyoteAssassin · Jul 23, 2011

Ha! Sometimes it just takes venting and then taking a new approach. Look what I found in the HTML.

The email was not displaying in the text box (that I would edit) but is in the source code.

Sweet!

Code:

<div class="row"><label for="email">Email:</label><input type="text" id="email" name="email" value=""  /></div>
                           <input type="Hidden" name="origEmail" value="[email protected]">

BassTrackerBoats · Jul 23, 2011

Rather than semi-hacking the site, I would tell the owners of the issue, you may or may not be rewarded but in the long run you would be sleeping pretty good at night.'

fanthomas · Jul 23, 2011

get the data and then tell them about the security issue and ask for a backlink if its a high pr site

CoyoteAssassin · Jul 23, 2011

BassTrackerBoats said:
Rather than semi-hacking the site, I would tell the owners of the issue, you may or may not be rewarded but in the long run you would be sleeping pretty good at night.'

I'm going to grab the data now that I can get it but also let them know. Personal info such as DOB, SSN, or CC#'s are not included. I'm only interested in the email address.

┼blackrat┼ · Jul 23, 2011

Hey look a coyote, should you shoot it?

2 with one shot, get the list and then honestly tell them about the flaw, accept any rewards gladly.

CoyoteAssassin · Jul 23, 2011

â”¼blackratâ”¼;3046184 said:
Hey look a coyote, should you shoot it?

Do both, get the list and then honestly tell them about the flaw, accept any rewards gladly.

Blackrat - Did you type that last part? "Do both, get the list and then honestly tell them about the flaw, accept any rewards gladly."

It is not in your posts but when I select Quote, it is there... weird.

moggwai · Jul 23, 2011

Im was checking out your seo on your site and i discovered u have a serious error that allows me to do bla bla.. heres proof..

Here,s what i would like to do, rewrite a contract to me and i can assure u this never happens again for $1500 a month etc ????

WOOD from the trees my friend !!

┼blackrat┼ · Jul 23, 2011

CoyoteAssassin said:
Blackrat - Did you type that last part? "Do both, get the list and then honestly tell them about the flaw, accept any rewards gladly."

It is not in your posts but when I select Quote, it is there... weird.

last minute editing lol

hispdcha · Jul 23, 2011

For you to know about the problem, you had to create it, am I right? If they have an IT security team or know anything about computer security, they may report you. I would just get the list and then send them a FULLY anonymous letter through snail mail telling them the problem. Do not, in anyway, give them your contact details or let them get any information on you. I would take the list and leave it be.

CoyoteAssassin · Jul 23, 2011

hispdcha said:
For you to know about the problem, you had to create it, am I right? If they have an IT security team or know anything about computer security, they may report you. I would just get the list and then send them a FULLY anonymous letter through snail mail telling them the problem. Do not, in anyway, give them your contact details or let them get any information on you. I would take the list and leave it be.

No, I did not create a problem. I simply found a whole in the system that will allow me to alter the URL so that I am able to gain access to other records.

They do have an IT person (individual). The company is a local group. The web is something they have just because it is expected. They make no money from the website, do not sell anything or the likes.

But yeah, I'll get it and run.

Jonny13131 · Jul 23, 2011

I would recommend that you reveal the flaw and when they thank you (at least they should do) ask if you can have the email addresses in return. Don't say I found a hole in your system and I will tell you what it is if you give me the email addresses. If you say that you will look like you are blackmailing them.

other_henry · Jul 23, 2011

CoyoteAssassin said:
...

So, is it OK (legally) for me to tell them that in exchange for their membership list that I will reveal the flaw?

Thoughts? What would you do?

If you decide to tell them about the flaw don't ask for anything in exchange, you might be accused of extortion.

When you report something like this there will be some very pissed off & embarrassed people looking to shoot the messenger.

I suggest that you report it anonymously using the anon remailer network.

CoyoteAssassin · Jul 23, 2011

Thanks guys for the comments. I appreciate the different opinions and looking out for the other party.

zerocoolflo · Jul 23, 2011

"hello , sorry to bother you, I've discovered a major flaw in your ****** and you can say that it is quite big because anyone who discovers it can access ***** . "

I can report/fix the problems that you have, providing proof after so you could be assured that I'm not trying to scam you.

Because your data is important to everyone ( especially you),and considering the gravity of the problem, the fixing/reporting ( if you know how to fix it go with fixing ) fee would be xxx.

Basically I would use something like that and make a little income

Have a nice day

cheatson · Jul 23, 2011

zerocoolflo said:
"hello , sorry to bother you, I've discovered a major flaw in your ****** and you can say that it is quite big because anyone who discovers it can access ***** . "

I can report/fix the problems that you have, providing proof after so you could be assured that I'm not trying to scam you.

Because your data is important to everyone ( especially you),and considering the gravity of the problem, the fixing/reporting ( if you know how to fix it go with fixing ) fee would be xxx.

Basically I would use something like that and make a little income

Have a nice day

You would have to be ultra confident that the other party would not view this as extortion even if it isn't strictly. One little thrown out law suit is still going to be expensive.

zerocoolflo · Jul 23, 2011

Eh, you don't do anything bad imho

You actually help the webmaster by telling him that he has problems and you offer yourself to help

What idiot would sue someone who tries to help him ? ( if yes, for what and probably wasting time/loosing )

Lmao

cheatson · Jul 23, 2011

CoyoteAssassin said:
Thanks guys for the comments. I appreciate the different opinions and looking out for the other party.

In my opinion you should just leave the list alone if it is company emails and don't report the finding to them could be more trouble than its worth.

Compare the value of work email conversions not caught by their auto filter with the prospect of being investigated should they see a pattern in the spam and link this back to you as a hacker (if you were to contact them). I am assuming you didn't "find" the list initially without using a proxy?

I found a flaw, should I report it???

Elite Member

Elite Member

Elite Member

Elite Member

Support Admin

Registered Member

Elite Member

Senior Member

Elite Member

Junior Member

Senior Member

Regular Member

Elite Member

Regular Member

Junior Member

Elite Member

Power Member

Newbie

Power Member

Newbie

Main Menu

Marketplace

Making Money

BlackHat World