HexBrain

PortSwigger Web Security · Report #366129

Activat burp suite pro with the old license after transfared to anothe account

N/Astatus
6upvotes
19 Jul 2018disclosed

Summary

@egyptghost1 attempted to social engineer our staff to obtain an extra license. It didn't work, and as social engineering and attacks on licensing are both explicitly forbidden in our bounty brief the report was marked as NA.

How it was found

Hi team.

I made 2 accounts and purchased burpsuite pro. The first account with this email :- ███████ The second account with this email :- ██████

I have opened a support ticket on Jun 13, 2018 05:26PM and the message is :-

Hi

Could you please add this account to my existing account

████ ███████

to may another account

Email address: ██████████ ███

and change the name from

licensed to Sara Badran [single user license]

To

Burp Suite Professional - licensed_to_Emad__Shanab_[single_user_license]

Because i made a purchase from my another account but my old license will expire in 2 month and i need to merge my new account with the old one in one license and please change the license hash because i feel Iam, get hacked

Thanks

Attachments | Burp_Suite_Professional_-licensed_to_Sara_Badran__single_user_license.txt

The another license is:-

Attachments | Burp_Suite_Professional_-licensed_to_Emad__Shanab__single_user_license.txt

I just need to merge the accounts or change the license name to me with new hash to avoid any one to use it .

Thanks

And the team replied to me with this message:--

Hi Emad,

We have transferred the license key on █████ to █████████’s account.

Please let us know if you need any further assistance.

Now the license have transferred to my another account but i still can activate the burp with the old license with licensed to Sara Badran [single user license]

Now i have 2 licenses with one price and 2 different names.

Please tell me if you need more information.

Thanks.

Impact

This issue can lead to use 2 license with 2 different names with one price.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original