search

gitcoinco / web

Grow Open Source
https://gitcoin.co
Other
1.78k stars 771 forks source link

Find XSS vulnerabilities across the site. #4112

Closed owocki closed 4 years ago

owocki commented 5 years ago

This is a bounty to find XSS vulnerabilities across the site. ( https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) )

I will payout 0.5 ETH per person for vulernabilities on the live site found! Scope is https://gitcoin.co

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

This issue now has a funding of 0.997 ETH (170.95 USD @ $171.47/ETH) attached to it.

aahutsal commented 5 years ago

@owocki Going to use xsser form Kali Linux distro. Sounds OK?

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Cancelled

Work has been started.

These users each claimed they can complete the work by 2 months from now. Please review their action plans below:

1) iansawyerjs has started work.

Hey! Let me know if you would like me to work on this! I will get it done best practice. I've never used gitcoin.co before, do funds transfer quickly after? 2) ciscohite has started work.

My current job provides me relevant experience and access to specialised tools like Comodo HackerProof, Acuentix, NetSParker etc. which makes it easier for me to scan this platform and even keep it under constant monitoring in case anything changes as the site is updated time to time 3) sachincool has started work.

Use burp to get an idea of what are the inputs on the site and what are the WAF's inplace. try to bypass any client-side protections, Look for Dom-Events and sinks. 4) 6ug has started work.

I am prolific security researcher and I just noticed vulnerability! :)

I like to know since this are security issues so how you like to get reported, should I create github issues? or email address?

Can you please share links/addresses please. 5) dummytree has started work.

i want to ask for just vlunerabilities xss was accepted or anything in the website

Learn more on the Gitcoin Issue Details page.

owocki commented 5 years ago

@owocki Going to use xsser form Kali Linux distro. Sounds OK?

no idea. worth a shot tho! pls just dont DDOS the site on me :)

Hey! Let me know if you would like me to work on this! I will get it done best practice. I've never used gitcoin.co before, do funds transfer quickly after?

yes i usually pay within a day or two of an accepted submission. almost always within a week

aahutsal commented 5 years ago

0.5 ETH per person or 0.5 ETH per XSS found, @owocki ?

owocki commented 5 years ago

i specced it as per person? contact me if you have several XSS vulns. if they are critical via OWASP i can do more

6ug commented 5 years ago

i specced it as per person? contact me if you have several XSS vulns. if they are critical via OWASP i can do more

Oh! I just saw this message. Okay, I will send you report at kevin@gitcoin.co.

6ug commented 5 years ago

@owocki just found one and sent report to your email. Looking ahead for another. :)

6ug commented 5 years ago

@owocki sent another one! :100:

6ug commented 5 years ago

@owocki sent third one. :100:

@owocki I also wanted to explore transaction area but we need ether for that and I don't have any. Could you please give me some test ether so I can try 3-4 transactions at least. Amount doesn't matter ETH 0.02-0.03 like also will work (Updated: Oops, I just found fuel fee takes 0.07 least so please do send more than this if you want me to test it). You can send that to 0x565EAAD5fDC9d88365bF36a337A2310Ca06775d2

owocki commented 5 years ago

@6ug will check them out

you can test in rinkeby with rinkeby eth, just use https://faucet.rinkeby.io/ to get some

6ug commented 5 years ago

Sent three more, @owocki thanks for rinkeby's idea :) Did not found anything in transaction but I'm still trying.

gitcoinbot commented 5 years ago

Issue Status: 1. Open 2. Started 3. Submitted 4. Done

Work for 0.997 ETH (215.97 USD @ $216.62/ETH) has been submitted by:

  1. @l-kh

@owocki please take a look at the submitted work:

oritwoen commented 5 years ago

Oh, I wonder what you found @l-kh

L-KH commented 5 years ago

Hello, After using WhatWeb - checks for X-XSS Protection Header. I get that there is a medium severity vulnerability "X-XSS Protection is not Present" it's as definition As the target is lacking this header, older browsers will be prone to Reflected XSS attacks: this is img about running website in IE old version. https://i.imgur.com/RbSzPDn.png and as Modern browsers does not face any issues with this vulnerability (missing headers). However, older browsers strongly recommneded to be upgraded

owocki commented 5 years ago

sorry, i'm slow or not getting it. whats the exploit path for the above?

oritwoen commented 5 years ago

@owocki None. I would say that it is rather an information note. It does not matter if this header exists or not if you can not do XSS.

This is simply information that if someone puts XSS on the platform, if this header exists, old browsers such as Internet Explorer will not execute it.

But it does not matter, because if someone discovers XSS, it will not be targeted at Internet Explorer users and will want to escalate to the latest browsers and rich users. In addition, it is hard to imagine that the portal Gitcoin was used by people with old and outdated software (browser).

Ping @L-KH

The HTTP X-XSS-Protection response header is a feature of Internet Explorer, Chrome and Safari that stops pages from loading when they detect reflected cross-site scripting (XSS) attacks. Although these protections are largely unnecessary in modern browsers when sites implement a strong Content-Security-Policy that disables the use of inline JavaScript ('unsafe-inline'), they can still provide protections for users of older web browsers that don't yet support CSP. Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

hamidous commented 5 years ago

i found one bug XSS in the website type info -Light spider results: 1 dynamic URLs of total 50 URLs crawled - Method: GET

gitcoinbot commented 4 years ago

Issue Status: 1. Open 2. Cancelled

The funding of 0.997 ETH (170.14 USD @ $170.65/ETH) attached to this issue has been cancelled by the bounty submitter