$4,000 Starbucks secondary context path traversal - Hackerone

📧 Subscribe to BBRE Premium: bbre.dev/premium
✉️ Sign up for the mailing list: bbre.dev/nl
📣 Follow me on Twitter: bbre.dev/tw
This video is an explanation of bug bounty report of critical vulnerability submitted on Hackerone to Starbucks bug bounty program. It was secondary context path traversal in application that was using microservices and allowed to access almost 100 million customer records.
Original blogpost:
samcurry.net/hacking-starbucks/
Original report:
hackerone.com/reports/876295
Presentation about the topic:
Slides: docs.google.com/presentation/...
Video: • Attacking Secondary Co...
Sam Curry:
/ samwcyo
hackerone.com/zlz
Justin Gardner:
/ rhynorater
hackerone.com/rhynorater
00:00 Intro
00:49 Microservice architecture
02:25 Identifying the vulnerability
03:52 bypassing WAF
04:42 exploiting the vulnerability
#path #traversal #microservices #hackerone #starbucks #secondary #context

[@BugBountyReportsExplained]

Welcome to the comment section! First, thanks for watching! Make sure you are subscribed if you liked the video! kzbin.info Follow me on twitter: twitter.com/gregxsunday ✉️ Sign up for the mailing list ✉️ mailing.bugbountyexplained.com/ ☕️ Support my channel ☕️ www.buymeacoffee.com/bountyexplained 🖥 Get $100 in credits for Digital Ocean 🖥 m.do.co/c/cc700f81d215

[@drset]

Excellent explanation, I had read this report when it came out, but you help me understand it better. Thanks!

[@BugBountyReportsExplained]

👌👌👌

[@gajendraupadhyay6740]

Thanks bro...Your way of explaining bounty report is extremely understandable.....keep it up...

[@InfiniteLogins]

It's very cool to see you break these down. As somebody who has experience in network pentesting, but am new to webapps/bug bounties, these explanations make it easier for me to realize how possible it is to actually be successful in that space. It also gives me ideas on what to look for. Thank you man, I hope great success for you and your channel.

[@BugBountyReportsExplained]

it's awesome to hear those words!!

[@saurabh5392]

You earned a sub today man. Great work and content! 👍👍 Thank you for your efforts 😎

[@BugBountyReportsExplained]

thanks man😎

[@DevilAlpacca]

I love your Channel! Please keep it up! Keep em coming!

[@BugBountyReportsExplained]

thanks👌 i will

[@dombruise9716]

Very clean and detailed. Liked and subscribed!

[@BugBountyReportsExplained]

welcome!

[@avisawade6190]

Thank you Buddy Awesome Explanation, Keep it UP

[@BugBountyReportsExplained]

thanks😊😊

[@cybersec9111]

Amazing video, keep doing these!

[@zombie9503]

Love the content, thanks man

[@BugBountyReportsExplained]

😊😊

[@robot67799]

I indeed learned something new from this video, thanks for sharing ❤️

[@charvi444]

Such a great video man

[@0xfsec]

Wow.. what an awesome explanation man.. Please more upload videos like this..

[@BugBountyReportsExplained]

thank you👌👌

[@aorsec8084]

Amazing content bro, keep it up!

[@BugBountyReportsExplained]

👌👌

[@ca7986]

❤️ you are doing an amazing job!

[@BugBountyReportsExplained]

thank you!

[@dhruvkandpal9909]

Excellent explanation!

[@BugBountyReportsExplained]

😊

[@skwtf]

Thank you! A question: Why back slash (\) for traversing, instead of forward slash(/)? Because it's IIS? Did he fingerprint the server type?

[@BugBountyReportsExplained]

Forward slash could be interpreted by the front-end server as the end of the parameter. URL encoding could be still decoded and in turn, double encoding might not have been decoded by the back-end. Thus, backslash is something that was not interpreted by the end of the URL parameter and at the same time interpreted as the path separator by the back-end. That's my guess. Good question, thanks!

[@dennismunyaka6537]

very informative and well explicated.

[@BugBountyReportsExplained]

Glad it was helpful!

[@RishabhMishraIndia]

Please keep it up! 🔥

[@BugBountyReportsExplained]

i will👌

[@bonniedean9495]

Isn't 4,000$ a very low amount? I'm sure the researchers could sell the exploit for way more on the black market.

[@Kay5322s]

Of course this vuln gotta earn 15-20k

[@BugBountyReportsExplained]

yeah, I'm slightly worried, that some hunters will start selling those vulns on black market for much bigger rewards. At least it would probably motivate bug bounty programs to start paying out comparable amounts.

[@VM-mo9ku]

yeahh man, Starbucks should be ashamed of themselves for this reward...

[@toolshack21]

thank you man

[@BugBountyReportsExplained]

👌👌

[@verenasantos444]

Thank you so much. Where is the video about shopify account takeover?

[@BugBountyReportsExplained]

here it is m.kzbin.info/www/bejne/kHfWpWZjp5Jsgsk

[@AmanSingh-zo6pn]

what is payload?

[@mr_ehmed]

keep doing..

[@BugBountyReportsExplained]

thank you

[@preetham3151]

Excellent

[@BugBountyReportsExplained]

😊

[@nikitabohuslavskii3651]

Great

[@SaRa-kj9ff]

Hi how to earn money please guide me I dnt how to start

[@akhilvarmahero]

where is poc video

[@BugBountyReportsExplained]

you have to find it

[@hdphoenix29]

you'r 6 minutes videos teach us a book Thanks man

[@katjastrand3955]

read better books

[@hdphoenix29]

@@katjastrand3955 :)) read some literature

[@BugBountyReportsExplained]

😊

[@unbalancedbinarytree2194]

First comment, first view, first like. Where's my trophy?

[@BugBountyReportsExplained]

thanks bro! here's my first reply 😂

[@sontapaa11jokulainen94]

And only 4000$???????? Fuck Starbucks.

[@BugBountyReportsExplained]

yeah, they need to consider changing their max payout considering how much customer data they process

[@sontapaa11jokulainen94]

@@BugBountyReportsExplained btw i subbed :)

[@BugBountyReportsExplained]

@@sontapaa11jokulainen94 thank you ;)

[@slavatar1337]

$4,000 is not enough for this vulnerability lol. You could get 4-5 times more on the black side. bug bounty sucks

[@user-wd3iz3se5i]

who is here from web security course?

[@BugBountyReportsExplained]

which one?