Hi everyone, Today, I'm going to share how I found a Local File Inclusion that affected companies like Facebook, Linkedin, Dropbox and many others.
The LFI was located at the cloud system of Oracle Responsys. For those who do not know Responsys is an enterprise-scale cloud-based business to consumer (B2C). Responsys gives every Business their own "private IP" to use the system in a private way. Business are not sharing IP with other companies.)
How did I found this bug?
Well as usual I was looking for bugs and I note that Facebook was sending me developer emails from the subdomain em.facebookmail.com. For example on my inbox, I had emails from firstname.lastname@example.org
This got me interested on the subdomain em.facebookmail.com and after a quick DIG I note that this subdomain was connected to "Responsys" which I had previously seen in other Pentests
Responsys is providing em.facebookmail.com with the email services as you can see above. The original link I foun…
Flickr is an image hosting and video hosting website, and web services suite that was created by Ludicorp in 2004 and acquired by Yahoo in 2005.
Flickr had a total of 87 million registered members and more than 3.5 million new images uploaded daily.In August 2011 the site reported that it was hosting more than 6 billion images and this number continues to grow steadily according to reporting sources.
I start doing my security research on flickr.com and I found some cool bugs but this XSS was my favorite because the XSS was showing on Flickr main page and on the Mobile interface at m.flickr.com.
Affecting millions of users for sure..
This attack works by inviting the Victim to a group. The XSS loads when the victim get notify about a group invitation. Making this XSS very dangerous and perfect to target specific people or people in general.
I report this two bugs to Yahoo Security team and I got two nice reward.
Google Shopping Expressis a same-day shopping service ("shop local stores online and get items delivered on the same day") fromGooglethat was launched on a free trial basis inSan FranciscoandSilicon Valleyin spring 2013 and publicly in September that year. This store XSS was showing at "Shopping Express Checkout" and by adding payload on the parameter "City" in wallet.google.com I could bypass restrictions and trigger this XSS back on Google Checkout. Image of Proof: This XSS was trigger just before paying pretty handy don't you think? Well I report this to Google Security Team and they reply very quick. Fixing this bug within a week:
I'm very happy to be back on Google Hall of Fame and I like to thanks Google Security Team for the reward. I create a video reproducing this XSS: