[CLOSED] ZIGGAP crowd sourced security auditing. 80.5 BTC in potential winnings!

[Mikej0h]

Not a security flaw, but bug:
Go to Buy Bitcoins -> Select nothing ("Select payment method") -> Enter address (12gKdNCYoEZ9SfnRkiouNJV2QrCdyC8ooD) -> Error page "Bad gateway"

Edit: and please include "labels" for the textboxes, I had to look in the source which field is for what (IE)...

The text boxes have labels in them, until you click in the text box and start typing.

I understand what you mean, I see them in the source however they not show up in my Internet Explorer...

EDIT; see screenshot below

[fcmatt]

Ssh should be using /etc/hosts.allow.  no reason to let every IP connect to it.

[paybitcoin]

And purchase another server to run ejabberd on for frontend.ziggap.com. Unless that's part of the service somehow.

Ssh should be using /etc/hosts.allow.  no reason to let every IP connect to it.

You could also set up a service like OpenVPN (UDP + drops any packets that don't have the HMAC = very good stealth) and then SSH & XMPP inside the VPN so there are no TCP ports open to the outside world except 80 and 443.

Surface area, etc.