HexBrain

HackerOne · Report #353

Session not expired on logout

Validstatus
$100bounty
22upvotes
19 Apr 2014disclosed

How it was found

hackerone.com website is not expiring the user's session immediately after logout.

Steps to verify:

  1. Log into the website - hackerone.com.
  2. Capture any request. For ex, profile edit page using burp proxy.
  3. Logout from the website.
  4. Replay the request captured in step 3 and notice it displays the proper response.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original