The DMZ

8:11 AM

@Arminius Are you going to disclose/document what you found and how?

Journeyman Geek

@Arminius properly applied poking I guess.

I actually think it did slip between the cracks rather than got ignored

I don't know why but the official stackexchange reply does not feel satisfying, although I don't really know what else they should say/do other than apologizing
I know a lot of people who would have gone wild and publicly disclosed it after X months. Heck some people would probably have sold it, abused it or bragged about it.
Therefore, kudos to @Arminius for the highly professionalism and ethical behaviour

Journeyman Geek

@HamZa we don't have perfect information under the hood, so to speak

8:38 AM

I don't know why but the official stackexchange reply does not feel satisfying. Maybe concretely state what steps they are going to take to prevent this from happening again? I know a lot of people who would have gone wild and publicly disclosed it after X months. Heck some people would probably have sold it, abused it or bragged about it already. Therefore, kudos to @Arminius for the highly professional and ethical behaviour. We should encourage such people/talent by taking them seriously. It is very frustrating when there's no reply after reporting a vulnerability. — HamZa 2 mins ago

thought it might be better out there in the public

or at least "more public" space

On another note, has anyone gone to https://www.offensivecon.org/ or followed one of their trainings?
Seems super dope

robyg72

9:15 AM

Has anyone followed courses offered by Hakin9? Are they valid for the cost they offer?

1 hour later…

10:23 AM

@HamZa missed it :(

saw the ads like 2 days after the con was over

but will definitely go there next year

10:46 AM

@TomK. i'm thinking to go, that is if my employer will pay for it

if that's the case, we might meet :D

11:18 AM

@HamZa I do have a spare bedroom

you live in the vicinity there?
i hope i can get my driving permit before that time and also get a car

yeah

also in Berlin

I thought I mentioned that before (8

cool
kind of awkward, my boss sent me a link to a training, and told me if i was interested
told him yeah would be awesome
then he said "it's only 450 early-bird"
So i reminded him that the 450 is for conference and training is 3500 for early birds
so he needed to discuss this with the other bosses # awkward

jaja
Berlin is biiiig (x4 amsterdam :_)

@HamZa Thanks for your kind words :) I agree that their reaction isn't totally satisfying

If it just "fell through the cracks", they would have eventually picked it up after these multiple attempts to get a status update

BTW if you folks meet up in Berlin let me know

11:35 AM

sure

do you live here or are you going to the conference? @Arminius

@TomK. living here

well, who knew

do you go to any meetups regularly or anything like that?

I'm kinda looking for something like that

(but was too lazy to register at ISACA to be honest :)

Nope, I don't go to any meet-ups here

@TomK. sounds very formal, colleagues of mine usually try to use "meetup"

11:40 AM

Many years ago I used to pass by at the CCC from time to time

yeah, I attended two talks that were organized via meetup, and these were kinda interesting, but nothing too interesting came out of that

or well.. nothing on a long-term basis

how's job hunting going?

I'm waiting on another decision to make a move

but I'll probably still be in Berlin in February ;)

@HamZa Regarding the vulnerability, it was really just a dull XSS at

https://openid.stackexchange.com/affiliate/form?affId=11&callback=https%3a%2f%2‌fstackexchange.com%2fusers%2fauthenticate'*prompt(document.domain)*'

. The "twist" is that the XSS only fires if you send it over POST which I guess is one of the things you just try during pentesting when you feel there is a WAF in play or so.

I also found some more interesting authentication-related bugs which I'll probably submit soon... since their security team is apparently now reorganized and super responsive :-)

@Arminius super cool

11:49 AM

something else: microsoft.com/en-us/msrc/bounty-microsoft-identity

Microsoft Bug Bounty Program for their authentication service

At least they're paying

12:21 PM

In the Deutsche Telekom bug bounty, XSS CSRF, LFI and RFI are out of scope. telekom.com/en/corporate-responsibility/…