I am working in Zerocopter as a researcher for quite long now. Well about hacking platforms the most lucrative thing is to hacking the hackers themselves ! I was looking into zerocopter's core application platform as I regularly use it. The thing about a bug is - If you try to look for it consciously you may never find it, on the other hand if you just keep using the features unconciously you will notice small changes leading to a good discovery. My finding was unconscious recon. Today I will discuss about two bugs I found on Zerocopter which enabled by external privileges on Zerocopter functionalities.

Bug 1: Disclosure of team members by a particular feature in the report.

This bug was due to access control of team members while managing a report. As a result It enabled me to mention literally any team member or platform researcher by certain keywords or characters. As a result I was able to identify researchers personally with their username. Even a team member does not have any access to my report I could know about him via his username as well as doing some manual OSINT recon.

Zerocopter addressed the issue quickly. the limited the researchers only to a particular report they were assigned to, disabling universal ability of the certain feature to mention only the researchers who are part of a report.

Bug 2: Special Character protection Bypass - Redirecting users to malicious websites via Researcher Front End

This was rather interesting one, Generally If we try to give any controlled or special Unicode character application blocks it. Consider I am giving you the link of https://www.twitter.com you will go to twitter. Instead I can give you a crafted Unicode URL of Twitter which is https://www.tѡіtter.com. Visually they both look similar however the second one will redirect you to hacker controlled website https://xn--ttter-n2e0f.com, So this type of evasion is generally not allowed in applications. Zerocopter also restricted such opportunity. However, while editing at a certain endpoint I noticed trough that endpoint we can pass these special characters to craft the URL. and after the request was sent to server It was accepted. meaning the crafted / unicode URL is visible on Researchers dashboard . Which enables him to redirect anyone to a malicious website. After submitting initial report Zerocopter took some time and confirmed and validated the existence of the issue

Though the complete fix took some time but it was fixed by Zerocopter.

For both cases Zerocopter was responsive with each step and mitigation process. Both fixes came with €€€

Takeaways:

1. Use an application to know its features betters
2. Discover and explore endpoints application endpoints and features.
3. Try to utilize character that exfiltrates additional / external data
4. It can be useful enough to get a valid bug.

If You have any questions / queries do let me know via comment section.