HackerOne · Report #105887
Know whether private program for company exist or not
Summary
Analysis of the researcher's PoC revealed an issue in the HTTP codes returned for the /thanks.json endpoint:
sandboxed team: https://hackerone.com/[sandboxed team handle]/thanks.json
Returned white page with Status Code:500 OK
private team: https://hackerone.com/[invite-only team handle]/thanks.json
Returned {"error":"You need to sign in or sign up before continuing."} with Status Code:401 OK
user: https://hackerone.com/[user handle]/thanks.json
Returned 404
We have corrected the issue by ensuring the same HTTP code is returned for both sandboxed and private teams.
How it was found
HI,
There are some company which are hosting private BB on HackerOne which are not visible unless they invite you. However, you can check if any company is hosting private BB on HackerOne or not if you can guess the username they use.
Generally most company chooses the same name as their company name like yahoo.
Now for eg, ████ hosts such private program on HackerOne. But if someone had to find out if they hosts such program on HackerOne, they just need to browse to
https://hackerone.com/<redacted>/thanks.json
Now since company name is ████, a user can easily guess that, username would be same.
The problem with above url is, it will display blank screen for a user. But this is indication that the program is exist on HackerOne which is private. If the username is not valid for eg I will change the name to ████ https://hackerone.com/<redacted>/thanks.json
It will display me page not found error.
So this indicates that, such program doesnt exist.
So the conclusion is
Blank screen- program exist privately page not found error- program doesnt exists