PortSwigger Web Security · Report #366129
Activat burp suite pro with the old license after transfared to anothe account
Summary
@egyptghost1 attempted to social engineer our staff to obtain an extra license. It didn't work, and as social engineering and attacks on licensing are both explicitly forbidden in our bounty brief the report was marked as NA.
How it was found
Hi team.
I made 2 accounts and purchased burpsuite pro. The first account with this email :- ███████ The second account with this email :- ██████
I have opened a support ticket on Jun 13, 2018 05:26PM and the message is :-
Hi
Could you please add this account to my existing account
████ ███████
to may another account
Email address: ██████████ ███
and change the name from
licensed to Sara Badran [single user license]
To
Burp Suite Professional - licensed_to_Emad__Shanab_[single_user_license]
Because i made a purchase from my another account but my old license will expire in 2 month and i need to merge my new account with the old one in one license and please change the license hash because i feel Iam, get hacked
Thanks
Attachments | Burp_Suite_Professional_-licensed_to_Sara_Badran__single_user_license.txt
The another license is:-
Attachments | Burp_Suite_Professional_-licensed_to_Emad__Shanab__single_user_license.txt
I just need to merge the accounts or change the license name to me with new hash to avoid any one to use it .
Thanks
And the team replied to me with this message:--
Hi Emad,
We have transferred the license key on █████ to █████████’s account.
Please let us know if you need any further assistance.
Now the license have transferred to my another account but i still can activate the burp with the old license with licensed to Sara Badran [single user license]
Now i have 2 licenses with one price and 2 different names.
Please tell me if you need more information.
Thanks.
Impact
This issue can lead to use 2 license with 2 different names with one price.