From P5 to P2 to 100 BXSS

From P5 to P5 to P2, from nothing to 1000+$ (BXSS) | by Mohamed Daher - Freedium Milestone: 20GB Reached We’ve reached 20GB of stored data — thank you for helping us grow! Patreon Ko-fi Liberapay Close < Go to the original From P5 to P5 to P2, from nothing to 1000+$ (BXSS) Hey there, hope you will like this write up :) Mohamed Daher Follow ~4 min read · April 22, 2020 (Updated: January 8, 2022) · Free: Yes Hey all :) Hope you guys are good as always. As you asked for on twitter (make sure to follow me @D aherMohamed4 ) Here is how I was able to escalate this bug from P5 to P2 and got rewarded +1000$. So let's start. It was the same private program as my last write up. So I've been hunting on this program for a week already and already reported all my findings so I was struggling to find any more bug. But not seeing them doesn't mean they don't exist :) So I decided to start over and create a new account. When I filled all the details, they asked me to verify my email first but I could also change the email to another one in case I made a mistake. I directly thought about Race-Condition to use any email without verifying it. Here's how you can do it (we'll assume that we have access to [email protected] and we want to register with [email protected]) 1/ Add an email to the account and open the email with the verification link but don't click on it yet (In my case I added [email protected] and opened the mail they sent me) 2/ On the website click on "change email". Change the email to the one you want to use without verification but don't click on send link now. (Now I changed the email to [email protected]) [email protected] is a temp email Here comes the tricky part. You have to click on the verification link and change your email at the same time. You can do that without burp but you may have to try a few times before it works so here is a method to make it work every time: Start burp and turn intercept on Now open the verification link you received on [email protected] then switch tab and validate the new email on the website ([email protected]) then turn intercept off. Burp will forward the 2 requests together and that's what we want. [email protected] was verified and I could now login to my account. In this case what you should do is to register with [email protected], sometimes you can get access to some cool admin features. But unfortunately for me it wasn't the case here but I still reported it and as expected, closed as P5. Thanks Roy But huh who are we to give up ? Now we have to escalate this to give a valid impact in order to be a valid bug. After some minutes I tried to escalate this to XSS. Did the same process but instead of entering a fake email in the second step I entered :