+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Tumblr XSS [Bug Bounty] (/Thread-Tumblr-XSS-Bug-Bounty)
Tumblr XSS [Bug Bounty] - BreShiE - 02-13-2014
As some of you may know, Tumblr recently introduced a bug bounty program and I found a reflective XSS within about 10 minutes of searching, an hour after the bounty was published. I submitted it to the site and got a bit worried after I noticed it had been patched and I had heard nothing back from Tumblr. Sure enough I got an email about an hour or two ago stating that I was owed $200 from Tumblr for finding and reporting this!
It was found inside of the korean language file for Tumblr. Albeit a small vulnerability in my eyes, Tumblr consideres this a "Major" vulnerability and paid out $200 for this!
![[Image: BgUnUNGCcAAxlmI.png]](https://pbs.twimg.com/media/BgUnUNGCcAAxlmI.png)
![[Image: 6U9d6.png]](http://puu.sh/6U9d6.png)
![[Image: BgUwrXrCUAE3k3j.png]](https://pbs.twimg.com/media/BgUwrXrCUAE3k3j.png)
RE: Tumblr XSS [Bug Bounty] - Satan - 02-13-2014
There is good money in bug hunting, if you do it quite a bit and report it immediately.
RE: Tumblr XSS [Bug Bounty] - Customer - 02-13-2014
Holy jeepers, batman!
$200 is pretty good for 10 minutes of work!
RE: Tumblr XSS [Bug Bounty] - 3SidedSquare - 02-13-2014
Well done, breshie! May I ask how you find stuff like this? Like, your thought process. I would never even think to look at the language files to find an XSS.
RE: Tumblr XSS [Bug Bounty] - BreShiE - 02-13-2014
(02-13-2014, 06:22 AM)3SidedSquare Wrote: Well done, breshie! May I ask how you find stuff like this? Like, your thought process. I would never even think to look at the language files to find an XSS.
If I told you that, I'd have to kill you. :3
Spoiler:
Kidding, I'll PM you how.
RE: Tumblr XSS [Bug Bounty] - OversouL - 02-13-2014
Wow, well done BreShie. I'm really impressed.
RE: Tumblr XSS [Bug Bounty] - BreShiE - 02-14-2014
I have receieved my payment now. God it's releaving to look at my PayPal balance and see that $200 there for some good I did for once. I'm glad I chose to go legit.
RE: Tumblr XSS [Bug Bounty] - Satan - 02-14-2014
Somewhat wish I was good at doing that sort of thing, I have a knack at finding things, just not when I'm looking for them.
RE: Tumblr XSS [Bug Bounty] - Mom - 02-14-2014
(02-14-2014, 02:32 AM)Satan Wrote: Somewhat wish I was good at doing that sort of thing, I have a knack at finding things, just not when I'm looking for them.
Open up something and go out of your way to not look for whatever is wanted then.
RE: Tumblr XSS [Bug Bounty] - OversouL - 02-14-2014
(02-13-2014, 07:07 AM)BreShiE Wrote: If I told you that, I'd have to kill you. :3
Spoiler:
Kidding, I'll PM you how.
Can I know to?
I mean I don't know how to XSS, but it would be a big help when I try to learn.