[BreShiE]

As some of you may know, Tumblr recently introduced a bug bounty program and I found a reflective XSS within about 10 minutes of searching, an hour after the bounty was published. I submitted it to the site and got a bit worried after I noticed it had been patched and I had heard nothing back from Tumblr. Sure enough I got an email about an hour or two ago stating that I was owed $200 from Tumblr for finding and reporting this!

It was found inside of the korean language file for Tumblr. Albeit a small vulnerability in my eyes, Tumblr consideres this a "Major" vulnerability and paid out $200 for this!

[Satan]

There is good money in bug hunting, if you do it quite a bit and report it immediately.

[Customer]

Holy jeepers, batman!

$200 is pretty good for 10 minutes of work!

[3SidedSquare]

Well done, breshie! May I ask how you find stuff like this? Like, your thought process. I would never even think to look at the language files to find an XSS.

[BreShiE]

Well done, breshie! May I ask how you find stuff like this? Like, your thought process. I would never even think to look at the language files to find an XSS.

If I told you that, I'd have to kill you. :3

Spoiler:

Kidding, I'll PM you how.

[OversouL]

Wow, well done BreShie. I'm really impressed.

[BreShiE]

I have receieved my payment now. God it's releaving to look at my PayPal balance and see that $200 there for some good I did for once. I'm glad I chose to go legit.

[Satan]

Somewhat wish I was good at doing that sort of thing, I have a knack at finding things, just not when I'm looking for them.

[Mom]

Somewhat wish I was good at doing that sort of thing, I have a knack at finding things, just not when I'm looking for them.

Open up something and go out of your way to not look for whatever is wanted then.

[OversouL]

If I told you that, I'd have to kill you. :3

Spoiler:

Kidding, I'll PM you how.

Can I know to? I mean I don't know how to XSS, but it would be a big help when I try to learn.