HackerOne · Report #111868
Report title and issue information prepopulated
Summary
In light of some recent disclosures and the reactions to them, I requested disclosure on this. This is my first report on HackerOne and I had no idea what I was doing. While I'm not killing it now, still continue to submit reports which get closed as Informative, often go through a dry spell of finding no vulnerabilities, I'd like to think since this submission, I'm improving and have provided value to HackerOne, Shopify, Twitter, MoneyBird, DrChrono, Veris and other private programs.
You can probably guess reading my submission, I was clueless to the fact that HackerOne made POST calls to auto save submissions. I also have the OWASP XSS link open in my screenshot and am testing trying to make HackerOne send unintended emails. I'm also not sure why I searched "get browser to execute JS". Pretty indicative of my skill level at the time.
I hope this helps others realize we all have to start somewhere. I, no doubt, have contributed to bug bounty noise. ██████████, █████, ████ and █████████ are great examples of an alternative means to reducing noise - each took the time from their schedules to sit down and teach me, and other new hackers who watch the interviews, how to improve. Additionally, all the hackers who disclose reports or publish detailed write ups should also be acknowledged as helping build the collective hacker community but the list would be too long to include here.
How it was found
I think this may be N/A to the bounty program but I'm seeing a weird situation so just wanted to at least flag as I'm not sure what is causing it in the event it's something worth you looking into...
Working through possible exploits on █████ last night, I entered some code to try and have their smtp server send additional emails in my stores contact form:
test%0aMAIL+FROM:+██████████%0d%0aRCPT+TO:+███████%0d%0aDATA%0d%0aFrom:+█████████%0d%0
When I logged into my Hackerone account today to play with the Markdown parser on Hackerone.com, I noticed that code in the Title of the potential issue. I think I then pasted it into the information box and went to another couple of pages. When I returned, the information was in both the title and information boxes. I figure there may be a cookie saving my prepopulated values so I can come back to an unfinished report but it was odd that code I submitted to a Shopify form showed up on Hackerone....
I thought this might be a browser thing so I logged out of my Google account on Chrome and still saw the issue. Then I opened up IE and logged into Hackerone and saw the issue.
Perhaps unrelated, but figure I'll include it in case it helps, when I was using Burb Suite to intercept Shopify form submissions, I also noticed some requests to Hackerone but didn't really pay attention to them at the time...
Anyways, hope this isn't a total waste of your time.