HexBrain

HackerOne · Report #118684

Abusing HOF rankings in limited circumstances

Informativestatus
3upvotes
21 Apr 2016disclosed

How it was found

HI,

I think you will close this as NA but i think you should resolve this bug at some point.

As we know submitting duplicate report of valid report earns you +2 point and also gives you HOF(known bug).

So you will appear in team's HOF as https://hackerone.com/security/thanks with 2 points

Now how this can be abused further to enhance your reputation points which will ultimately yields you higher ranking in HOF

So if you have points in HOF with points Greater than 0 and less than 5

here how we can abuse it further Pre-Requistes 1.you are in HOF of some team with points greater than 0 and less than 5

Steps

  1. submit a valid report 2.team closes the report as NA. at this point your main reputations will go -5. but in HOF it will become 0 as it cant go in negatives. 3.you send more info 4.Team reopens the bug.
  2. now in HOF, instead of restoring your old points(which is less than 5), it will give +5 point
  3. So even if they close the report to informative later, you got +5 points without resolving any of your report!

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original