Hacker News Reader

Comment by captaincrunch | Hacker News Reader

My previous comment didn't get so much attention, perhaps this will...

https://hulbee.com/?query=perl%20-e%20'print%20%22%3CIMG%20S...

Edit: I had an example of displaying the IP address back to the user from my server, but it went over capacity in a few short minutes, so I took it down and removed the link. I am sure everyone gets the point, specially with a lot of the other examples provided by other HN users below.

Here is a screen shot for future reference: http://imgur.com/PkAGhqn

View on HN

nice find, however the perl command is unnecessary.

    <IMG SRC=http://kt-media.knowtechie.netdna-cdn.com/wp-content/uploads/2014/12/hacker1.jpg>

works as well. the server isn't executing perl, it's just not escaping client input allowing you to add html tags to the result page.

edit: i should say - it's absurd that anyone can launch a website with this kind of vulnerability in 2015. every html rendering framework i've ever used/read about automatically sanitizes user input when generating the html. the only accidental way i can imagine someone doing this is building html from string concatenations...

edit2: for a simple challenge, try to embed other tags. like A or SCRIPT

They "fixed" it. Well, there's still another.

https://hulbee.com/?query=%3C%2Fscript%3E%3Cimg%20src%3Dsdf%...

It runs on Chrome and bypasses the filter.

Edit: for context, the parent found an XSS issue. It was patched within a few hours. The patch was incomplete, and this one still worked. So, not only do they get it wrong for launch. When presented with an exploit they don't even patch the full vulnerability. I'll trust my data with someone who understands security, thank you very much.

Red herring. Serious bugs have been found in lots of respect worthy software and service efforts. It just needs to be fixed. You are holding a toddler up to the standards of a pre-teen (which is the highest I'd put Google).

The question here is whether this is a respect worthy effort at privacy protection.

EDIT: Flaws or holes have been found in Tor. Does that mean we reject the Tor effort outright? If anything, the holes found in Tor are more serious and fundamental, because they raise doubts about Tor's approach and whether their goal can ever be achieved. An HTML injection hole in Hulbee is simply an issue of incomplete execution of their vision, which may or may not be forgivable depending on the technical and non-technical circumstances (which none of us here know yet).

I admire their efforts, but serious efforts need to start with the fundamentals.

I would argue the Tor example is not a valid comparison. Tor is a very complex system. It has a vast attack surface for holes, especially if you ignore boundaries like assuming there is a globally omniscient adversary.

Contrastingly, websites sanitizing inputs has been done for quite some time; it is hardly new, difficult, or complex. It's fundamental. I would guess most people's answer is that this is not a sufficient effort to protect privacy or security.

whether this is a respect worthy effort at privacy protection

If they've launched with an HTML injection vulnerability, their security infrastructure is not sufficient to protect your privacy. Game over.

If they don't store your IP (or personalized info) they probably do not need that high security standards ;)

XSS injection is possible too:

https://hulbee.com/?query=%3CIMG%20SRC%3D..%2FImages%2Flogo-...

So much for your privacy I guess. That most likely isn't the only thing wrong with their infrastructure if they missed that.

Deleted comment

You can also run JS on the page. Try searching for:

    jv98y4yt47tgfuf4<img src=dhdu4ye.jpg onerror="alert('XSS')">

Deleted comment

You could log data about the user (example by captaincrunch in their updated comment), directly modify the way the page looks (e.g. a fake virus alert page) or simply redirect the user to any site you want.

It's bad on a 'normal' site, but even worse here given their target market.

This is not a bug, you are just uninformed: a platform that allows anybody to use anybodys machine for anything is the final business model in web 2.0. Everybody in the startup world is getting crazy about this.

BTW google is doing it, Mickysoft and Apple is doing it - only difference is that they try to maintain exclusive customer access to these features, but it does not work out always.

hulbee entering the scene as an unrestricted distributed code execution platform freely available for anybody will change everything!

Is is not a bug, it is a feature (image search, that does not work too well).

When you place an IMG tag, it tries to find some results by that image (similar to Google's seach by image->URL). Try using an invalid reference or IFRAME SRC.

Edit: I stand corrected. They do embed poorly-filtered request text into the results page.

This is false.

There's no reason I should be able to embed the following onto someone else's page:

    https://hulbee.com/?query=%3Ca%20href%3D%22%23%22%20obfuscate%3D%22238942932djwdj928%22%20onClick%3D%22alert('pwnd')%3B%22%3Eclick%20here%20for%20results%3C%2Fa%3E&region=browser&uiLanguage=browser

Reply on news.ycombinator.com