How I secured singles’ favorite website
Hello everyone hope all are safe and doing good. I am Vasanth from Madurai, Tamilnadu, and a part-time bug bounty hunter I have been acknowledged by Google, Apple, Microsoft, GitHub, Pornhub, and 10+.
This is my second writeup in this I will share how I secured Pornhub and how I placed my name in the Hall of fame 🤓
Let’s Go
One day I was feeling very bored and I have seen one post already on LinkedIn that one person got a bounty from Pornhub at that time. I wondered how he have found bugs in that website🤔.
I also visited pornhub.com normally only at that time I don’t have a mind to test this website but I cannot able to enter that website☹️.
Hmm at that time only I came to know that porn sites are banned in INDIA. Now it is time to go to a foreign went to the USA and opened the site opened successfully🔥.
Entered the site successfully but at the time the site is very very slow 🥵😏where it was loading a long time ufff…! very bored then I noticed we can able to create an account. The site is very slow I thought of creating an account created an account.
First I didn’t care about this again visited the home page and checked but nothing came😐 still it was loading.
Entered into account settings and just normally I was checking all the options when I entered into the personal information page👀 one thing caught my attention.
I observed I cannot able to update my information why? because to access all features we need to verify the mail address then only it is possible to update our information this seems sounds interesting
It’s time to enter into hacking mode👨💻😌
The first thing in mind comes when we see the field is disabled we will go to inspect the element and will remove the disabled tag tried this method
<div class=”disabledField”>Please confirm your email</div>
In the above when I tried to change from “disabled” to “enabled”
When I changed I cannot able to see the textbox🙄🧐 tried the other way but whenever I change the default value the textbox disappears.
Nothing I cannot able to do now at that time I had another idea why not I can try the account with a verified one. I created another account and I have verified that account and now when I see the personal information all the fields are enabled. Now in the name field checked with inspect element
<input type=”text” name=”full_name” value=”” maxlength=”40">
We can see this one is completely different with an unverified account. Just copied this value and pasted it into the unverified account like this we can do for all the fields personal fields, Home town, and all the fields which are all disabled.
Entered the name and submitted
After finishing and again when I checked in the personal information.
The name is not visible again😐 it showed please confirm your email
Sad life…
Next I checked in “My Profile” Page the name was displayed there
Boom..!!
After that without wasting time reported this to the Pornhub team and it got traiged but unfortunately, this issue was not eligible for bounty because it doesn’t affect other users and just I got only “Hall of fame”
Really this one was unexpected I didn’t expect that I will be acknowledged by Pornhub. This is the power of inspect element 💥you don’t need burpsuite alone to find bugs just analyze the website you can find the bugs and think out of the box always when testing.
Happy to Secure the most visited website in the world.
Hope you will like this writeup soon will see it in the next writeup.
“Don’t wait for the dream Chase it”
Thanks for taking the time to read my write-up.
Do Follow Techiepedia for more Interesting write-ups!
