[100bit.co.in] Earn up to 0.1 BTC for finding bugs

[sbankerdemon]

your captcha is too weak and is almost useless to prevent bruteforce attacks and attacks like creating lots of tickets as mentioned above. I would advise to use strong captcha.

It can be easily decoded with any OCR for example

Code:

https://code.google.com/p/tesseract-ocr/downloads/list

use tesseract-ocr-setup-3.02.02.exe

after installing this just run command

tesseract captcha.png decoded.txt -l eng

example:



It will be accurate 95% of times.

It is possible for an attacker to code some automated tool to launch bruteforce attacks, create 1000's of new users, create lot of supprot tickets etc.

thanks

How will the attacker create 1000's of new users ? It seems email authentication is required to create each user.

Yea he can't forgot about email authentication. But still this captcha beats the purpose of using captcha.

[1715174541]

1715174541

[Jimmy Wales]

Yea he can't forgot about email authentication. But still this captcha beats the purpose of using captcha.

Is there some SQL injection possible at email authentication link ? It seems another user was talking about it or is that fixed now ?

[sbankerdemon]

Yea he can't forgot about email authentication. But still this captcha beats the purpose of using captcha.

Is there some SQL injection possible at email authentication link ? It seems another user was talking about it or is that fixed now ?

I am not aware it was there before or not but seems to be fixed now.

[PotatoPie]

your captcha is too weak and is almost useless to prevent bruteforce attacks and attacks like creating lots of tickets as mentioned above. I would advise to use strong captcha.

It can be easily decoded with any OCR for example

Code:

https://code.google.com/p/tesseract-ocr/downloads/list

use tesseract-ocr-setup-3.02.02.exe

after installing this just run command

tesseract captcha.png decoded.txt -l eng

example:



It will be accurate 95% of times.

It is possible for an attacker to code some automated tool to launch bruteforce attacks, create 1000's of new users, create lot of supprot tickets etc.

thanks

How will the attacker create 1000's of new users ? It seems email authentication is required to create each user.

Yea he can't forgot about email authentication. But still this captcha beats the purpose of using captcha.

I already mentioned about using OCR Tesseract in my list and @OP didn't seem to care. You're 100% correct saying that it's possible to create thousands of accounts though. I could create a POC right now and make 100k+ accounts. Email verification / authentication is easily bypassable. I can just set up a mail server, buy a basic domain and just iterate through random email addresses on that domain and fetch the verification codes and verify them. This is an extremely simple process and I could clog up the server with thousands of users.

In addition to this, there are more vulnerabilities that have been unpatched.
1. Post variable country on http://www.100bit.co.in/trade.php is SQL injectable.
2. Post variable trade on http://www.100bit.co.in/trade.php is SQL injectable.
3. http://www.100bit.co.in/support.php?mode=change_ststus&status=1&ticket_id=[ticketid] allows you to close or open any ticket regardless if you own it or not. This also has no CSRF or captcha protection on it.
4. http://www.100bit.co.in/order.php?mode=del_interest&id=[interestid] seems like you can delete other peoples interests as well.

I could probably find even more, but seeing as the owner didn't want to pay me out for the others I found even though they were totally unique to the previous founds, I'm not going to waste anymore time on it. 100bitcoin, when you feel like actually paying out, then I may consider taking another look at it.

[100bitcoin]

As promised, here is the list of bug bounty winners...

MagicSnow (https://bitcointalk.org/index.php?action=profile;u=239728) => 1EvbdVpBHZbyT9AVY4xBASTisoWpGH5B1J = 0.1
Bugs Found: XSS, SQLi, Unauthenticated Ticket access, Unauthenticated Order deletion.

seoincorporation (https://bitcointalk.org/index.php?action=profile;u=334783) => 1BtcBoSSnqe8mFJCUEyCNmo3EcF8Yzhpnc = 0.05
Bugs Found: Automated ticket creation, Independenly found XSS attack though MagicSnow PMed it before.

franckuestein (https://bitcointalk.org/index.php?action=profile;u=225121) => 0.01
Bugs Found: Spelling Mistake

Roberson (https://bitcointalk.org/index.php?action=profile;u=490361) => 1CBUepodCZvoQnPYLM4oNPf6U3hQAZDBuw = 0.03
Bugs Found: Found 404 error led by broken link

RealPhotoshoper (https://bitcointalk.org/index.php?action=profile;u=497745) => ? = 0.03
Bugs Found: Blank registration page after wrong input and a Good suggestion for email

At this moment we are waiting for the address of RealPhotoshoper before sending the payments. We have sent him a PM. Also PotatoPie was contacted about some bugs, but we never heard of him.

All of them have been paid...

https://blockchain.info/tx/8b8c6380391edd484571722696548710a7c6ebc1f82618dd25507037a0c4fb2b

@PotatoPie Previously we sent you a PM which you did not reply. We have sent you another PM. If you still do not reply, we can not reward you any bug bounty. Whoever is finding the bug needs to respond to our PM so that we can fix those issues.

[Coinbuddy]

It says
Please provide an eight character alphanumeric password.
But i can set password as "abcdefig"

Another thing
I just need to put captcha when submitting a ticket.It does not say that you must write subject and description.So people can spam the system by using a bot!

@100bitcoin
I think you missed this

[seoincorporation]

As promised, here is the list of bug bounty winners...

MagicSnow (https://bitcointalk.org/index.php?action=profile;u=239728) => 1EvbdVpBHZbyT9AVY4xBASTisoWpGH5B1J = 0.1
Bugs Found: XSS, SQLi, Unauthenticated Ticket access, Unauthenticated Order deletion.

seoincorporation (https://bitcointalk.org/index.php?action=profile;u=334783) => 1BtcBoSSnqe8mFJCUEyCNmo3EcF8Yzhpnc = 0.05
Bugs Found: Automated ticket creation, Independenly found XSS attack though MagicSnow PMed it before.

franckuestein (https://bitcointalk.org/index.php?action=profile;u=225121) => 0.01
Bugs Found: Spelling Mistake

Roberson (https://bitcointalk.org/index.php?action=profile;u=490361) => 1CBUepodCZvoQnPYLM4oNPf6U3hQAZDBuw = 0.03
Bugs Found: Found 404 error led by broken link

RealPhotoshoper (https://bitcointalk.org/index.php?action=profile;u=497745) => ? = 0.03
Bugs Found: Blank registration page after wrong input and a Good suggestion for email

At this moment we are waiting for the address of RealPhotoshoper before sending the payments. We have sent him a PM. Also PotatoPie was contacted about some bugs, but we never heard of him.

All of them have been paid...

https://blockchain.info/tx/8b8c6380391edd484571722696548710a7c6ebc1f82618dd25507037a0c4fb2b

@PotatoPie Previously we sent you a PM which you did not reply. We have sent you another PM. If you still do not reply, we can not reward you any bug bounty. Whoever is finding the bug needs to respond to our PM so that we can fix those issues.

I get the 0.05 payment, thx to user 100Bitcoin.

[100bitcoin]

It says
Please provide an eight character alphanumeric password.
But i can set password as "abcdefig"

Requesting users to provide alphanumeric password is a suggestion for strong password. But, if someone provides a weak one, it is their choice and we allow it.

Another thing
I just need to put captcha when submitting a ticket.It does not say that you must write subject and description.So people can spam the system by using a bot!

Unless the CAPTCHA is broken, one can not spam the system using bot instead of allowing blank post in subject/description.

[Jimmy Wales]

Also there is a full path disclosure vulnerability in captcha.php

If you save the captcha image from this page and view in hex editor you can see the complete server path to the file.

Is it a bug ? How does it affect the service ? What harm an attacker can do by knowing the full path of captcha.php ?

[andulolika]

Hey if you ever think about translating the webpage i can do Spanish and Romanian, English and between themselves.
Thanks.

[sbankerdemon]

your captcha is too weak and is almost useless to prevent bruteforce attacks and attacks like creating lots of tickets as mentioned above. I would advise to use strong captcha.

It can be easily decoded with any OCR for example

Code:

https://code.google.com/p/tesseract-ocr/downloads/list

use tesseract-ocr-setup-3.02.02.exe

after installing this just run command

tesseract captcha.png decoded.txt -l eng

example:



It will be accurate 95% of times.

It is possible for an attacker to code some automated tool to launch bruteforce attacks, create 1000's of new users, create lot of supprot tickets etc.

thanks

How will the attacker create 1000's of new users ? It seems email authentication is required to create each user.

Yea he can't forgot about email authentication. But still this captcha beats the purpose of using captcha.

I already mentioned about using OCR Tesseract in my list and @OP didn't seem to care. You're 100% correct saying that it's possible to create thousands of accounts though. I could create a POC right now and make 100k+ accounts. Email verification / authentication is easily bypassable. I can just set up a mail server, buy a basic domain and just iterate through random email addresses on that domain and fetch the verification codes and verify them. This is an extremely simple process and I could clog up the server with thousands of users.

In addition to this, there are more vulnerabilities that have been unpatched.
1. Post variable country on http://www.100bit.co.in/trade.php is SQL injectable.
2. Post variable trade on http://www.100bit.co.in/trade.php is SQL injectable.
3. http://www.100bit.co.in/support.php?mode=change_ststus&status=1&ticket_id=[ticketid] allows you to close or open any ticket regardless if you own it or not. This also has no CSRF or captcha protection on it.
4. http://www.100bit.co.in/order.php?mode=del_interest&id=[interestid] seems like you can delete other peoples interests as well.

I could probably find even more, but seeing as the owner didn't want to pay me out for the others I found even though they were totally unique to the previous founds, I'm not going to waste anymore time on it. 100bitcoin, when you feel like actually paying out, then I may consider taking another look at it.

If you reported it before me then you should get the bounty.

[100bitcoin]

your captcha is too weak and is almost useless to prevent bruteforce attacks and attacks like creating lots of tickets as mentioned above. I would advise to use strong captcha.

It can be easily decoded with any OCR for example

Code:

https://code.google.com/p/tesseract-ocr/downloads/list

use tesseract-ocr-setup-3.02.02.exe

after installing this just run command

tesseract captcha.png decoded.txt -l eng

example:



It will be accurate 95% of times.

It is possible for an attacker to code some automated tool to launch bruteforce attacks, create 1000's of new users, create lot of supprot tickets etc.

thanks

How will the attacker create 1000's of new users ? It seems email authentication is required to create each user.

Yea he can't forgot about email authentication. But still this captcha beats the purpose of using captcha.

I already mentioned about using OCR Tesseract in my list and @OP didn't seem to care. You're 100% correct saying that it's possible to create thousands of accounts though. I could create a POC right now and make 100k+ accounts. Email verification / authentication is easily bypassable. I can just set up a mail server, buy a basic domain and just iterate through random email addresses on that domain and fetch the verification codes and verify them. This is an extremely simple process and I could clog up the server with thousands of users.

In addition to this, there are more vulnerabilities that have been unpatched.
1. Post variable country on http://www.100bit.co.in/trade.php is SQL injectable.
2. Post variable trade on http://www.100bit.co.in/trade.php is SQL injectable.
3. http://www.100bit.co.in/support.php?mode=change_ststus&status=1&ticket_id=[ticketid] allows you to close or open any ticket regardless if you own it or not. This also has no CSRF or captcha protection on it.
4. http://www.100bit.co.in/order.php?mode=del_interest&id=[interestid] seems like you can delete other peoples interests as well.

I could probably find even more, but seeing as the owner didn't want to pay me out for the others I found even though they were totally unique to the previous founds, I'm not going to waste anymore time on it. 100bitcoin, when you feel like actually paying out, then I may consider taking another look at it.

If you reported it before me then you should get the bounty.

Can you please check if the bugs you mentioned still do exist in the system or they are fixed now ? Please do let us know if you can find any other bug. Please PM us with example. Also, please provide your bitcoin address...

[btc_enigma]

Register is not working
When i clicked on activation email

http://100bit.co.in/authenticate.php?user_id=5uD5a%2BbTvEY9K%2F3jT2%2Fc13slAAw8VxCmngaR6O1YaD8%3D

Its redirecting to register page and doing nothing

[Jimmy Wales]

Register is not working
When i clicked on activation email

http://100bit.co.in/authenticate.php?user_id=5uD5a%2BbTvEY9K%2F3jT2%2Fc13slAAw8VxCmngaR6O1YaD8%3D

Its redirecting to register page and doing nothing

It seems the registration page clearly states the following...

Warning! We are working on the system. New registration is disabled for now.

[100bitcoin]

Register is not working
When i clicked on activation email

http://100bit.co.in/authenticate.php?user_id=5uD5a%2BbTvEY9K%2F3jT2%2Fc13slAAw8VxCmngaR6O1YaD8%3D

Its redirecting to register page and doing nothing

It seems the registration page clearly states the following...

Warning! We are working on the system. New registration is disabled for now.

We have enabled new registration again...

[Mehek]

hey I have got a bug..I cannot view the captcha verification on my opera mini browser....but when I opened with the uc browser then I am able to view it....please fix this

[Jimmy Wales]

hey I have got a bug..I cannot view the captcha verification on my opera mini browser....but when I opened with the uc browser then I am able to view it....please fix this

I dont think they can do much about it. Google NoCaptcha ReCaptcha does not work on partial javascript browsers like Opera Mini or old IE browsers. That should not be counted as a bug. As such Google NoCaptcha ReCaptcha is a very safe and reliable one.

[Johny Depp]

Could not find any more bug. When do you plan to remove the warning from registration page ?

[mrhelpful]

At this point, I dont think theres any bugs to find.

I could be wrong, but the very basic ones that were obvious are long gone for some free btc lol. So anyone hoping to get it that way youre out of luck, its more of the indepth coder to see if its vulnerable or not.

[googleindo]

what is this? http://www.100bit.co.in/admin , let me know if this helpful.
also maybe in 404 error page you should added text like " the page is not found " or something else