When PornHub launched their public bug bounty program, I was pretty sure that most of the low hanging fruits of vulnerabilities would be taken care of and already reported. When I first started poking around, I found my first vulnerability in less than 15 minutes. The second vulnerability was found a few minutes afterward. I have never in my entire bug hunting career found bugs this quickly, so it was pretty exciting.
In return, I received two payments of $250 and a really really cool T-Shirt + stickers that I posted on Reddit here:
When I posted this on Reddit I had no idea it would be so popular and raise so many questions. Most people asked “What was the hack?” followed by “Why would you hack PornHub?” and I couldn’t talk about it until…now. (These vulnerabilities have now been fixed.)
I found and reported two reflected cross-site scripting (XSS) vulnerabilities within 20 minutes of browsing the PornHub Premium website. Cross site scripting, if you don’t know what that is, is a type of vulnerability that enables an attacker to run dangerous scripts on a website. OWASP sums it up pretty nicely here:
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.
The first one was found using the “redeem code” section of the site – it didn’t check to see if the code being entered in the text input for the redeem code was an actual payload, so I was able to use the following payload to reflect the script on the page:
PAYLOAD+STACK++%3E%27" /Autof<K>ocus /O<K>nfocus=confirm`1`//&error=1
The first part of the payload “PAYLOAD STACK” ensures that the rest of the payload is sent through. If I entered:
++%3E%27" /Autof<K>ocus /O<K>nfocus=confirm`1`//&error=1
Without the words in front of it, the application would reject it and nothing would appear on the page. Entering something non-malicious to begin would trick the validator, and in turn, allow the payload to execute.
The second vulnerability was also a XSS. This was was a bit simpler, and was found by entering a payload in a URL parameter that only appears once to new users… which is why I think it wasn’t found until now – most bug hunters like to get a feel of a website before they start poking around and trying to get things to break, but usually I take the different approach and use incognito windows so that the website thinks it’s the first time I’ve ever visited the site before. This is where the vulnerability existed.
I noticed that the PornHub Premium site was mostly off-limits unless you paid to access it. Before you could even pay, there is a “pop-up” window that displays to the user that they are going to be viewing pornography and to either enter or exit by clicking on a button. What I also noticed is that once you selected “enter”, there was a part of the URL that changed and added a parameter. This vulnerable parameter was &compliancePop=no_gateway – this is where I was able to enter:
And I got a really nice “1” to appear on the screen, which shows evidence of cross-site scripting. I reported both of these vulnerabilities to PornHub and they were triaged within 24 hours.
I’d like to thank the folks at PornHub for running such a fair, quick responding program and keeping their users safe. Also – thanks for the amazing T-Shirt! Thanks also to the folks at Reddit for being so interested in this that I had to send over 200 pm’s to people who wanted to know what I did…hopefully this lives up to the promise that I would tell you about it, and sorry it took so long.
I have other bugs and vulnerabilities that are cooler and more intense than this one coming soon, so check back later and I’ll share them with you. Additionally, you can follow me on Twitter to stay up to date with my bugs and what I’m doing, if you wish.