My First "Hall of Fame" from ifixit.com

As a white hat I have reported several high risk application security vulnerabilities in the past. But all of them were either for the clients for whom I was working or to the employers from where I was deriving my monthly paycheck.

This time I thought to try my hand on the bug bounty program's run by several companies/organizations. The sole motto was to help them identify security weaknesses associated with their respective web products/applications and in turn earn some fame for yourself.

In May 2013, I got my first break-through. I reported a "Stored XSS" instance to ifixit.com. One of the "textarea" associated with a form in ifixit.com was found vulnerable to stored XSS. The JavaScript payload used by me to detect the vulnerability was:

</textarea><img src=1 onerror=alert('XSSed') 

The complete chronology of the responsible vulnerability disclosure is as under:

  

                           23 May 2013 at 6:41 p.m: Vulnerability reported to ifixit.com
                               23 May 2013 at 6:42 p.m: Got an automated mail response from ifixit.com
                               25 May 2013: Stored XSS instance fixed by ifixit.com
                               4 June 2013: My name was included in ifixit.com Hall of Fame for Year 2013                               

Stored XSS POC

This "Stored XSS" earned me my first "Hall of Fame" from ifixit.com which is indeed special to me.

ifixit.com Hall of Fame

My joy knew no bounds when I received the goodies sent by ifixit.com. I want to sincerely thanks ifixit.com security team for their diligent and professional approach in handling this responsible vulnerability disclosure. It clearly shows the organization's commitment towards information security.