[zorayo]

Hello i got a critical security hole on freelancer.com and fiverr.com,
Is there any one who is willing to be part on exploitation kindly comment down.

[n0shmon]

Sorry, to confirm what you're asking. Are you looking for an account to exploit in order to demonstrate the vulnerability to collect a bug bounty ETC?

[mothered]

Hello i got a critical security hole on freelancer.com and fiverr.com

Do you have unrestricted/elevated back-end access?

[zorayo]

Hello i got a critical security hole on freelancer.com and fiverr.com

Do you have unrestricted/elevated back-end access?

Hello i able to done Url tempering attack.in order to deposit virtual/fake $

[mothered]

Hello i got a critical security hole on freelancer.com and fiverr.com

Do you have unrestricted/elevated back-end access?

Hello i able to done Url tempering attack.in order to deposit virtual/fake $

Are you referring to web parameter tampering, by manipulating/exploiting the application data?

[zorayo]

Do you have unrestricted/elevated back-end access?

Hello i able to done Url tempering attack.in order to deposit virtual/fake $

Are you referring to web parameter tampering, by manipulating/exploiting the application data?

Able to edit the actual amount of deposit.by editing http request in order by doing Url tempering...
The hole is working on Upwork.com too

---

Hello i able to done Url tempering attack.in order to deposit virtual/fake $

Are you referring to web parameter tampering, by manipulating/exploiting the application data?

Able to edit the actual amount of deposit.by editing http request in order by doing Url tempering...
The hole is working on Upwork.com too

I just link my paypal account and just done deposit of $1 and while redirecting(bouncing back to the checkout page) i edit the request and make it like $1000,$2000,$3000....
The fund works to pay for any client over the freelancer platform..

[Stratus]

Where's the money coming out of? Does it come out of the paypal account you link, or does it just create the funds from thin air? Also have you cashed it out yet? How do you know that the $500 isn't just a front end display and the server has the actual value stored internally?

[Charonone]

Where's the money coming out of? Does it come out of the paypal account you link, or does it just create the  funds from thin air? Also have you cashed it out yet? How do you know that the $500 isn't just a front end display and the server has the actual value stored internally?

That's a great question i want to find out myself too. I'm interested in hacking these "freelancer" companies.

[XHR]

My guess is this is just a visual bug.
The system will probably block the cashout.

[Severun]

Sounds interesting. Have they fixed it? I don't think that such services have strong security systems. Any vulnerability can remain unfixed for months, if not years. Recently I tried to find something on ithire.com, but they seem fine. Also, I would not expect decent bug bounty compensation from freelance services. They don't have a lot of valuable data. Compared to messengers, they have nothing at all. Maybe get some personal data of freelancers, but what's the point? Perhaps really, it was just a visual bug.