{"id":53579,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah"},"modified":"2021-01-02T13:04:14","modified_gmt":"2021-01-02T11:04:14","slug":"ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","title":{"rendered":"Sulmi n\u00eb HackerOne, q\u00eb lejon qasjen n\u00eb raportet e mbyllura p\u00ebr vulnerabilitetet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Platforma HackerOne, e cila u ofron mund\u00ebsin\u00eb hulumtuesve t\u00eb siguris\u00eb t\u00eb informojn\u00eb zhvilluesit p\u00ebr zbuluar vulnerabilitete dhe t\u00eb marrin shp\u00ebrblime p\u00ebr k\u00ebt\u00eb, ka marr\u00eb raport<\/a><\/noindex> raportin e saj p\u00ebr nj\u00eb thyerje t\u00eb siguris\u00eb. Nj\u00eb nga hulumtuesit arriti t\u00eb fitoj\u00eb akses n\u00eb llogarin\u00eb e nj\u00eb analisti t\u00eb siguris\u00eb n\u00eb kompanin\u00eb HackerOne, e cila ka mund\u00ebsin\u00eb p\u00ebr t\u00eb par\u00eb materiale t\u00eb mbyllura, p\u00ebrfshir\u00eb informacionin rreth vulnerabiliteteve q\u00eb ende nuk jan\u00eb eliminuar. N\u00eb gjith\u00eb koh\u00ebn e ekzistenc\u00ebs s\u00eb platform\u00ebs, hulumtuesve u \u00ebsht\u00eb paguar n\u00eb total 23 milion dollar\u00eb p\u00ebr zbuluar vulnerabilitete n\u00eb produktet e m\u00eb shum\u00eb se 100 klient\u00ebve, p\u00ebrfshir\u00eb Twitter, Facebook, Google, Apple, Microsoft, Slack, Pentagonin dhe Marina e SHBA.<\/p>\n

\u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb theksohet se kapja e llogaris\u00eb ishte e mundur p\u00ebr shkak t\u00eb faktor\u00ebve njer\u00ebzor\u00eb. Nj\u00eb nga hulumtuesit d\u00ebrgoi p\u00ebr shqyrtim nj\u00eb aplikim p\u00ebr nj\u00eb vulnerabilitet potencial n\u00eb HackerOne. Analisti i HackerOne, gjat\u00eb shqyrtimit t\u00eb aplikimit, p\u00ebrpiqej t\u00eb riprodhonte metod\u00ebn e propozimit t\u00eb thyerjes, por nuk mundi ta riprodhoj\u00eb problemin, dhe autori i aplikimit mori nj\u00eb p\u00ebrgjigje me k\u00ebrkes\u00ebn p\u00ebr detaje t\u00eb tjera. Nd\u00ebrkoh\u00eb, analisti nuk e v\u00ebrejti se s\u00eb bashku me rezultatet e kontrollit t\u00eb pasuksessh\u00ebm pa e dashur d\u00ebrgoi p\u00ebrmbajtjen e Cookie-s\u00eb s\u00eb tij sesionale. N\u00eb ve\u00e7anti, gjat\u00eb dialogut, analisti dha nj\u00eb shembull t\u00eb nj\u00eb k\u00ebrkese HTTP t\u00eb kryer me utilitarin curl, duke p\u00ebrfshir\u00eb kokat HTTP, nga t\u00eb cilat harroi t\u00eb pastronte p\u00ebrmbajtjen e Cookie-s\u00eb sesionale.<\/p>\n

Hulumtuesi vuri re k\u00ebt\u00eb gabim dhe arriti t\u00eb fitoj\u00eb akses n\u00eb llogarin\u00eb privilegjuar n\u00eb faqen hackerone.com, thjesht duke e p\u00ebrdorur vler\u00ebn e v\u00ebrejtur t\u00eb Cookie-s\u00eb pa pasur nevoj\u00eb t\u00eb kalonte n\u00ebp\u00ebr sistemin shum\u00eb-faktorik t\u00eb verifikimit. Sulmi u b\u00eb i mundur, pasi n\u00eb hackerone.com nuk u p\u00ebrdor lidhja e sesionit me IP ose shfletuesin e p\u00ebrdoruesit. Identifikuesi problematik sesional u hoq dy or\u00eb pas publikimit t\u00eb raportit p\u00ebr rrjedhjen. P\u00ebr informimin mbi k\u00ebt\u00eb problem, hulumtuesit i \u00ebsht\u00eb vendosur t\u00eb paguhet nj\u00eb shp\u00ebrblim prej 20 mij\u00eb dollar\u00ebsh.<\/p>\n

HackerOne ka iniciuar nj\u00eb audit p\u00ebr t\u00eb analizuar mund\u00ebsin\u00eb e ndodhis\u00eb s\u00eb t\u00eb tilla rrjedhjes s\u00eb Cookie-ve n\u00eb t\u00eb kaluar\u00ebn dhe p\u00ebr t\u00eb vler\u00ebsuar potencialet e rrjedhjes s\u00eb informacionit t\u00eb mbyllur mbi problemet e klient\u00ebve t\u00eb sh\u00ebrbimit. Auditi nuk zbuloi ndodhi rrjedhjesh n\u00eb t\u00eb kaluar\u00ebn dhe p\u00ebrcaktoi se hulumtuesi q\u00eb demonstroi problemin mund t\u00eb kishte marr\u00eb informacionin p\u00ebr rreth 5% t\u00eb t\u00eb gjitha programeve t\u00eb paraqitura n\u00eb sh\u00ebrbim, p\u00ebr t\u00eb cilat analisti kishte akses, identifikuesi sesional i t\u00eb cilit ishte p\u00ebrdorur.<\/p>\n

P\u00ebr t\u00eb mbrojtur nga nj\u00eb sulm i till\u00eb n\u00eb t\u00eb ardhmen, \u00ebsht\u00eb realizuar lidhja e identifikuesit sesional me adres\u00ebn IP<\/a> dhe filtrimi i identifikuesve sesional\u00eb dhe tokeneve t\u00eb verifikimit n\u00eb komente. N\u00eb t\u00eb ardhmen, planifikojn\u00eb t\u00eb z\u00ebvend\u00ebsojn\u00eb lidhjen me IP me lidhjen me pajisjet e p\u00ebrdoruesve, pasi lidhja me IP \u00ebsht\u00eb e pak\u00ebndshme p\u00ebr p\u00ebrdoruesit me adresa dinamike. Gjithashtu, \u00ebsht\u00eb vendosur t\u00eb zgjerohen sistemet e regjistrit me informacionin mbi aksesin e p\u00ebrdoruesve n\u00eb t\u00eb dh\u00ebna dhe t\u00eb realizohet nj\u00eb model i aksesit t\u00eb granuluar t\u00eb analist\u00ebve n\u00eb t\u00eb dh\u00ebnat e klient\u00ebve.<\/p>\n

<\/a><\/noindex><\/p>\n

Burimi: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u043e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c \u0432\u0437\u043b\u043e\u043c\u0435. \u041e\u0434\u043d\u043e\u043c\u0443 \u0438\u0437 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0430\u043d\u0430\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 HackerOne, \u0438\u043c\u0435\u044e\u0449\u0435\u0433\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0441\u043c\u043e\u0442\u0440\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u043e\u0432, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0441\u043e \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f\u043c\u0438 \u043e\u0431 \u0435\u0449\u0451 \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445. \u0417\u0430 \u0432\u0440\u0435\u043c\u044f \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u0447\u0435\u0440\u0435\u0437 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53579","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sulmi ndaj HackerOne, i cili lejon t\u00eb fitohet akses n\u00eb raportet e mbyllura p\u00ebr vulnerabilitete | ProHoster","description":"Platforma HackerOne, e cila u ofron mund\u00ebsin\u00eb hulumtuesve t\u00eb siguris\u00eb t\u00eb informojn\u00eb zhvilluesit p\u00ebr zbuluar vulnerabilitete dhe t\u00eb marrin shp\u00ebrblime p\u00ebr k\u00ebt\u00eb, ka marr\u00eb","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 HackerOne, \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0432\u0448\u0430\u044f \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u043e\u0442\u0447\u0451\u0442\u0430\u043c \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 | ProHoster","og:description":"\u041f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 HackerOne, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 \u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0437\u0430 \u044d\u0442\u043e \u0432\u043e\u0437\u043d\u0430\u0433\u0440\u0430\u0436\u0434\u0435\u043d\u0438\u044f, \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/ataka-na-hackerone-pozvolivshaya-poluchit-dostup-k-zakrytym-otchyotam-ob-uyazvimostyah","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2021-01-02T11:04:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53579","title":null,"description":"","keywords":"","keyphrases":null,"primary_term":null,"canonical_url":"","og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-08 20:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:50","updated":"2026-02-08 20:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=53579"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53579\/revisions"}],"predecessor-version":[{"id":157785,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/53579\/revisions\/157785"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=53579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=53579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=53579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}