Hackevents FirstBlood - Live Hacker Challenge

Hackevents are virtual live hacking events to motivate & encourage our members as well as enable them to collaborate with each other. Learn more about our hackevents here.

Event Winner

HolyBugx
16 bugs discovered

Scope: 'FirstBloodHackers' (version 1.0)

Please note the parts of text below (describing the web app) and information on our web application is satire.

"FirstBlood" is a hospital that understands and care for everyone. Yes, everyone.

The world is a beautiful place, and so are you. Humans are so gifted we possess the ability to spread & share love which as a result makes others' feel good. Isn't that amazing?! We embrace love here at FirstBloodHackers and make sure you are looked after and we'll do our best to hack you back on track! Spread a little love today.

It is absolutely fine to stream/record yourself hacking on FirstBlood as well as making educational content using the web application

Available functionality

HackerCamps: "Fixing HackerBack".
Hackers are known to spend long periods of time on their computers, sometimes (okay, quite a lot!) slouching with bad posture. Overtime this can cause what we call, HackerBack, which is where your back is craving a good ole massage and a rest from hacking.

Book and manage your appointment with us safely and securely. Let us know your allergies so we can do our best to look after you. If you are unable to make your appointment then please make sure to cancel your appointment. We don't like it when people appointments and do not let us know.

Credentials available

You can login as ADMINISTRATOR with the following credentials: unauthorised to view!. This account has full access to everything on the portal. We are unable to provide you with a non administrator account, however if you are able to figure out how to obtain one then we give you full permission to play around with these.

Report Title	Severity	Hunter	Vuln type
FirstBlood runs on http	Informative	zseano Level 1	Server misconfiguration
PII leak via /drpanel/drapi/qp.php?name=sanjay	CRITICAL	codersanjay Level 3	Authorisation Issue
Viewing/Cancelling anyone's appointment	High	th4nu0x0 Level 2	Insecure direct object reference
IDOR on /api/qa.php	High	jpdev Level 3	Insecure direct object reference
The patient email can be changed even though the application UI mentioned that this is not allowed.	High	bobbylin Level 4	Application/Business Logic
Open Url redirection	Low	d20s84 Level 3	Open Redirect
Editing other users appointments with IDOR	High	pichik Level 4	Insecure direct object reference
Stored XSS on	High	smhtahsin33 Level 3	Stored XSS
Users information disclosure via /attendees/event.php endpoint	CRITICAL	panya Level 7	Info leak
Enumerating PII.	CRITICAL	mava Level 2	Application/Business Logic
Newly created Doctor account was able to search for patient info via the query api	CRITICAL	bobbylin Level 4	Application/Business Logic
OpenRedirect on Secure Logout	Low	jonlaing Level 2	Open Redirect
Invite Code leaking on Reddit	High	mava Level 2	Authorisation Issue
/attendees/event.php authoriation bypass using X-SITE-REQ: permitted	CRITICAL	jpdev Level 3	Info leak
Multiple Register on same Username	High	mava Level 2	Authorisation Issue
Open URL Redirect on /drpanel/logout.php	Low	rintox Level 3	Open Redirect
Doctor Registration code misconfiguration	High	vermsec Level 4	Authorisation Issue
Leakage of P2 information of users who have taken appointment	High	iffu Level 5	Insecure direct object reference
Open redirect on the logout.php endpoint [COLLAB]	Low	holybugx Level 5	Open Redirect
[IDOR] Modifying anyone's Appointment information	High	th4nu0x0 Level 2	Application/Business Logic
New Account Patient Information restriction bypass	CRITICAL	vermsec Level 4	Authorisation Issue
account takeover via re-register with the same username	High	parisk Level 4	Authorisation Issue
Stored XSS at http://firstbloodhackers.com:49229/api/ba.php (POST) and aptid enumeration at /api/qa.php can be used to steal cookie	High	0xconft Level 5	Stored XSS
Un-Authorized users can access "/drpanel/drapi/qp.php" endpoint and access users PII [COLLAB]	CRITICAL	holybugx Level 5	Authorisation Issue
Stored XSS on /drpanel/drapi/query.php?aptid=<ID>	High	rintox Level 3	Stored XSS
aptid enumeration via http://firstbloodhackers.com:49276/api/qa.php can be used to leak Appointment data	High	0xconft Level 5	Insecure direct object reference
Open redirect on logout	Low	0xSaltyHash Level 3	Open Redirect
Modification of the appointement's data - Collaboration with Jomar	High	serizao Level 2	Application/Business Logic
doctorAuthed cookie given at /register.php can be used to modify patient email at Appointment Form /manageappointment.php	High	0xconft Level 5	Application/Business Logic
Leak arbitrary users appointment details Manage/delete them	High	ibruteforce Level 4	Insecure direct object reference
Info leak at http://firstbloodhackers.com:49280/attendees/event.php?q=560720	CRITICAL	0xconft Level 5	Info leak
Invite Code Leaked on Reddit leading to broken Authorisation	High	jpdev Level 3	Authorisation Issue
I can see & cancel other patients appointments	High	thefawsec Level 2	Insecure direct object reference
IDOR in aptid which grants access to every appointment	High	pichik Level 4	Insecure direct object reference
Cancel arbitrary reports through 'aptid' parameter	High	ibruteforce Level 4	Insecure direct object reference
PII disclosure using GET request	CRITICAL	thefawsec Level 2	Authorisation Issue
[COLLAB] 1 Click XSS can lead to Admin Account Takeover	CRITICAL	0xblackbird Level 5	Stored XSS
A User can modify the Email of their appointment despite being disabled for safeguarding reasons	High	xnl-h4ck3r Level 4	Application/Business Logic
Stored XSS via canceled appointment message	CRITICAL	jtcsec Level 4	Stored XSS
Leaking PII data of users who have appointments using stored XSS and IDOR	High	xnl-h4ck3r Level 4	Stored XSS
Open redirect at http://firstbloodhackers.com:49330/drpanel/logout.php	Low	0xconft Level 5	Open Redirect
XSS using ref Parameter	Medium	mava Level 2	Reflective XSS
Registring to the application as a doctor due to the leaked invitation code [COLLAB]	High	holybugx Level 5	Authorisation Issue
Invite codes do not expire after use	High	jpdev Level 3	Authorisation Issue
New doctors can query appointments and users informations using vulnerable /drpanel/drapi/query.php endpoint	CRITICAL	holybugx Level 5	Application/Business Logic
Info leak on reddit leads to create acc with admin privileges	High	pichik Level 4	Authorisation Issue
An new user account can bypass security and view all patient data	High	xnl-h4ck3r Level 4	Authorisation Issue
An new user account can bypass security and view all appointment data	CRITICAL	xnl-h4ck3r Level 4	Application/Business Logic
Information Leak leads to full backend access	High	jonlaing Level 2	Authorisation Issue
Account takeover of a doctor account is possible due to flawed logic in the registration process	High	bobbylin Level 4	Authorisation Issue
IDOR at http://firstbloodhackers.com:49369/drpanel/drapi/qp.php can be used to query patient data without doctor account	CRITICAL	0xconft Level 5	Authorisation Issue
Reflective XSS at http://firstbloodhackers.com:49369/register.php	Medium	0xconft Level 5	Reflective XSS
Un-Authorized access to critical users PII through the vulnerable /attendees/event.php endpoint	CRITICAL	holybugx Level 5	Info leak
Info leak for events and attendees including PII data	CRITICAL	xnl-h4ck3r Level 4	Info leak
POST Based Reflected XSS on Login	Medium	smhtahsin33 Level 3	Reflective XSS
Stored XSS on /drpanel/drapi/query.php?aptid	High	iffu Level 5	Stored XSS
Reflected XSS via Javascript Scheme	Medium	smhtahsin33 Level 3	Reflective XSS
Reflected XSS	Medium	smhtahsin33 Level 3	Reflective XSS
IDOR - Restricted doctor can view all the details of the patient such as contact details etc.	CRITICAL	ibruteforce Level 4	Application/Business Logic
Open Redirect /drpanel/logout.php	Low	iffu Level 5	Open Redirect
IDOR on ma.php	High	jpdev Level 3	Insecure direct object reference
IDOR - Restricted user can view the details of hospital user.	CRITICAL	ibruteforce Level 4	Authorisation Issue
IDOR 2 on ma.php - confirms numerical id for bug chain to report 127 without the need for drpanel	High	jpdev Level 3	Insecure direct object reference
It is possible to view patient's data as a new doctor	CRITICAL	0xblackbird Level 5	Application/Business Logic
Reflective XSS at http://firstbloodhackers.com:49421/login.php can be used to steal cookie	Medium	0xconft Level 5	Reflective XSS
Stored XSS through the appointments cancelation message leading to account takeover	CRITICAL	holybugx Level 5	Stored XSS
Open redirect on /drpanel/logout.php	Low	0xblackbird Level 5	Open Redirect
Leaked invite ID allows anyone to register for an account.	High	0xblackbird Level 5	Authorisation Issue
Potentially takeover other doctors account?	High	ibruteforce Level 4	Authorisation Issue
Creating a new user with same username overrides old password which can lead to account takeover	High	0xblackbird Level 5	Authorisation Issue
Invitation code leaked on reddit	High	codersanjay Level 3	Authorisation Issue
Doctor Invitation Code doesn't expire after first uage	High	0xSaltyHash Level 3	Authorisation Issue
IDOR on newly registered doctor	CRITICAL	codersanjay Level 3	Application/Business Logic
IDOR on /drpanel/drapi/qp.php endpoint	CRITICAL	codersanjay Level 3	Application/Business Logic
Patient's can modify their information without authorization on "/manageappointment.php" endpoint	High	holybugx Level 5	Application/Business Logic
Leak PII through the events API	CRITICAL	jomar Level 4	Info leak
New Doctors can use the api to get patients data	CRITICAL	0xSaltyHash Level 3	Application/Business Logic
Reflective XSS through the vulnerable ref header on /register.php endpoint	Medium	holybugx Level 5	Reflective XSS
Reflected xss on login.php	Medium	0xblackbird Level 5	Reflective XSS
Event attendees leaked	CRITICAL	0xSaltyHash Level 3	Info leak
Reflected XSS on register.php	Medium	0xblackbird Level 5	Reflective XSS
Reflective XSS on /login.php endpoint through the vulnerable `ref` parameter	Medium	holybugx Level 5	Reflective XSS
Reflected xss on register.php	Medium	0xblackbird Level 5	Reflective XSS
Unauthenticated access to PII data on /drpanel/drapi/qp.php	CRITICAL	0xblackbird Level 5	Authorisation Issue
Hackerback event attendees information disclosed through /attendees/event.php	CRITICAL	0xblackbird Level 5	Info leak
Can know who are attending an HackerBack event	CRITICAL	codersanjay Level 3	Info leak
P2 information disclosure of the users attending the events	CRITICAL	iffu Level 5	Info leak
PII Creditcard information leaking via Event	CRITICAL	mava Level 2	Info leak
Creating Admin account using a leaked token on r/BugBountyHunter and using restricted API calls .	High	th4nu0x0 Level 2	Auth issues
Found a way to register as non-admin user	High	iffu Level 5	Authorisation Issue
Stored XSS payload allowed in names when making an appointment can leak admin cookie	High	xnl-h4ck3r Level 4	Stored XSS
Adding cookie to the request allows us to modify way more data then allowed	High	0xblackbird Level 5	Application/Business Logic
PII disclosure - I can see email,contact No of patients who is/has attending/attended the hackerback event	CRITICAL	thefawsec Level 2	Info leak
[Two Tales of Info leak] Site setting can be accessed and leaked a "x-site-req" header. This header can be used to get HackerBack event attendees info.	CRITICAL	bobbylin Level 4	Info leak
Emails and comments of other users can be changed using IDOR on aptID	High	holybugx Level 5	Insecure direct object reference
New doctors can query appointments and users information using /drpanel/drapi/qp.php endpoint	CRITICAL	holybugx Level 5	Application/Business Logic
New doctors are able to view patient's private data through /drpanel/drapi/qp.php	CRITICAL	0xblackbird Level 5	Application/Business Logic
GUUID is replaceable by an 8 digit number which makes it vulnerable to IDOR	High	0xblackbird Level 5	Insecure direct object reference
Authorisation vulnerabilities with cookies	High	xnl-h4ck3r Level 4	Application/Business Logic
Reflected XSS on using the hidden "goto" parameter leads to Admin Account Takeover	High	holybugx Level 5	Reflective XSS
Information Disclosure allowing an attacker to register as a doctor	High	c3phas Level 4	Authorisation Issue
Stored Cross site scripting	CRITICAL	d20s84 Level 3	Stored XSS
Privilege Escalation on /drpanel/drapi/query.php and /drpanel/drapi/query.php	CRITICAL	iffu Level 5	Application/Business Logic
Application Logic allowing access to unauthorised information belonging to patients	CRITICAL	c3phas Level 4	Application/Business Logic
IDOR found on /api/ma.php	High	rintox Level 3	Insecure direct object reference
Stored XSS on admin Side - Collaboration with Jomar	High	serizao Level 2	Stored XSS
Application Logic Issue allowing a doctor who is not authorised to view patients information on the dashboard	CRITICAL	c3phas Level 4	Application/Business Logic
script inclusion leads to phishing,ato,monitoring of clicks of the user [sxss] and intresting vulnerablity	High	thesecguy Level 2	Stored XSS
Stored XSS on /drpanel/drapi/query.php	High	0xblackbird Level 5	Stored XSS
sxss`leads to manything entire site manipulation	CRITICAL	thesecguy Level 2	Stored XSS
Info leak that leads to non admin login	High	d20s84 Level 3	Authorisation Issue
Stored XSS on /drpanel/drapi/query.php endpoint leading to Admin Account Takeover	High	holybugx Level 5	Stored XSS
[COLLAB] Stored XSS on message param through appointment annulation allow admin ATO	CRITICAL	jomar Level 4	Stored XSS
rxss leads to ato accountakeover	Medium	thesecguy Level 2	Reflective XSS
Reflective XSS on Register page leading to leak of PII data	Medium	xnl-h4ck3r Level 4	Reflective XSS
Reflected xss on login.php leads to account takeover	Medium	0xblackbird Level 5	Reflective XSS
Reflective XSS on Login page (requiring interaction), leading to leak of PII data	Medium	xnl-h4ck3r Level 4	Reflective XSS
Can change email when modifying an appointment	High	rintox Level 3	Application/Business Logic
Account Creation with same Username overrides the one made before.	High	smhtahsin33 Level 3	Authorisation Issue
IDOR to view Patient Information from a Lower Privileged User	CRITICAL	smhtahsin33 Level 3	Application/Business Logic
IDOR in Search Patient Functionality Leads to PII Leakage	CRITICAL	smhtahsin33 Level 3	Application/Business Logic
DOM XSS	Medium	smhtahsin33 Level 3	Reflective XSS
Patient's information can be obtained from a non admin account	CRITICAL	d20s84 Level 3	Application/Business Logic
Recently registered doctor account can still query /drpanel/drapi/qp.php & /drpanel/drapi/query.php	CRITICAL	0xconft Level 5	Application/Business Logic
Docauth cookie used to amend email - Additionally chained with Rpt 127 and 129 - This is the full report.	High	jpdev Level 3	Insecure direct object reference
Stored XSS on Admn API endpoint for querying Appointment	High	xnl-h4ck3r Level 4	Stored XSS
Event is leaking attendees Personal information.	CRITICAL	th4nu0x0 Level 2	Info leak
a Doctor can cancel patient's appointments	High	twsec Level 2	Insecure direct object reference
Open Redirect via logout ref parameter	Low	codersanjay Level 3	Open Redirect
Stored XSS on /manageappointment.php using the message parameter leading to account takeover	High	holybugx Level 5	Stored XSS
Attacker can register a user name that has already been registered	High	xnl-h4ck3r Level 4	Authorisation Issue
Stored XSS via malicious appointment message leads to ATO	High	jtcsec Level 4	Stored XSS
Stored XSS on yourappointments.php can lead to account takeover	High	0xblackbird Level 5	Stored XSS
Stored XSS on cancelled.php endpoint	High	codersanjay Level 3	Stored XSS
idor	High	thesecguy Level 2	Insecure direct object reference
Reflected XSS on /login.php using ref parameter	Medium	iffu Level 5	Reflective XSS
CWE-601 Open Redirect on GET /drpanel/logout.php via ref param	Low	jpdev Level 3	Open Redirect
[COLLAB] Query appointment with simple ID / Bypass front end restriction	High	jomar Level 4	Insecure direct object reference
Open Redirect Vulnerability Observed in the Firstbloodhacker.com	Low	netmous3 Level 4	Open Redirect
New Doctor Registration Invitation Code Leaked to the Public	High	netmous3 Level 4	Authorisation Issue
Reflected XSS on login Page via ref paramater	Medium	codersanjay Level 3	Reflective XSS
Critical PII of Patients Leaked to the Public	CRITICAL	netmous3 Level 4	Application/Business Logic
Reflected XSS via ref parameter on login	Medium	vermsec Level 4	Reflective XSS
Reflected XSS on register page	Medium	pichik Level 4	Reflective XSS
Email id can be modified for a patient	High	d20s84 Level 3	Application/Business Logic
PII Data of the Fistbloodhacker.com All patient's were Publicly Accessible	High	netmous3 Level 4	Insecure direct object reference
Reflected XSS on /login.php using the GET paramter 'goto'	Medium	iffu Level 5	Reflective XSS
Open Redirect on /login.php via goto body parameter	Low	iffu Level 5	Reflective XSS
register as non admin doctor	High	twsec Level 2	Authorisation Issue
Open redirect in logout function	Low	YouGina Level 3	Open Redirect
a non admin doctor can still view patient information using the api	High	twsec Level 2	Application/Business Logic
Hackerback Event Details Along with Attendee's Personal Information Exposed to Public	CRITICAL	netmous3 Level 4	Info leak
Stored XSS + stealing cookies through XSS hunter	High	vigilante Level 4	Stored XSS
Cross Site Scripting vulnerability in client firstname/lastname	High	YouGina Level 3	Stored XSS
Stored XSS on query.php via lname & fname parameter	High	vermsec Level 4	Stored XSS

holybugx

Level 5

16 unique findings 14 reports disclosed

jtcsec

Level 4

15 unique findings 2 reports disclosed

0xblackbird

Level 5

15 unique findings 16 reports disclosed

Researcher	'FirstBlood' Bugs	Hacking Time	RESPECT
holybugx Level 5	16 — 14 disclosed	`1 days, 6 hours, 10 minutes and 35 seconds`	32.5M
jtcsec Level 4	15 — 2 disclosed	`1 days, 20 hours, 46 minutes and 59 seconds`	30.0M
0xblackbird Level 5	15 — 16 disclosed	`0 days, 8 hours, 56 minutes and 56 seconds`	25.5M
#4. jomar Level 4	9 — 3 disclosed	`0 days, 21 hours, 23 minutes and 48 seconds`	17.5M
#5. xnl-h4ck3r Level 4	11 — 11 disclosed	`2 days, 8 hours, 1 minutes and 43 seconds`	17.5M
#6. ibruteforce Level 4	10 — 5 disclosed	`1 days, 0 hours, 18 minutes and 33 seconds`	16.0M
#7. codersanjay Level 3	10 — 8 disclosed	`1 days, 5 hours, 27 minutes and 22 seconds`	15.5M
#8. serizao Level 2	8 — 2 disclosed	`0 days, 13 hours, 50 minutes and 1 seconds`	14.5M
#9. 0xconft Level 5	9 — 9 disclosed	`1 days, 22 hours, 22 minutes and 18 seconds`	14.5M
#10. thesecguy Level 2	10 — 4 disclosed	`2 days, 5 hours, 59 minutes and 42 seconds`	13.0M
#11. iffu Level 5	9 — 9 disclosed	`2 days, 23 hours, 18 minutes and 18 seconds`	12.5M
#12. smhtahsin33 Level 3	9 — 8 disclosed	`0 days, 4 hours, 41 minutes and 28 seconds`	12.0M
#13. jpdev Level 3	7 — 8 disclosed	`0 days, 22 hours, 23 minutes and 55 seconds`	12.0M
#14. pichik Level 4	9 — 4 disclosed	`2 days, 9 hours, 23 minutes and 40 seconds`	12.0M
#15. th4nu0x0 Level 2	5 — 4 disclosed	`0 days, 7 hours, 13 minutes and 24 seconds`	9.5M
#16. d20s84 Level 3	6 — 5 disclosed	`0 days, 19 hours, 30 minutes and 1 seconds`	9.0M
#17. panya Level 7	7 — 1 disclosed	`0 days, 7 hours, 37 minutes and 57 seconds`	9.0M
#18. shivam18u Level 3	6 — 0 disclosed	`1 days, 13 hours, 10 minutes and 29 seconds`	9.0M
#19. vigilante Level 4	6 — 1 disclosed	`2 days, 2 hours, 18 minutes and 28 seconds`	8.5M
#20. mava Level 2	5 — 5 disclosed	`0 days, 18 hours, 57 minutes and 55 seconds`	7.5M
#21. vermsec Level 4	5 — 4 disclosed	`0 days, 13 hours, 32 minutes and 7 seconds`	7.5M
#22. bobbylin Level 4	4 — 4 disclosed	`1 days, 1 hours, 50 minutes and 49 seconds`	6.0M
#23. sh3llf1r3 Level 6	5 — 0 disclosed	`0 days, 8 hours, 59 minutes and 38 seconds`	6.0M
#24. rintox Level 3	4 — 4 disclosed	`0 days, 7 hours, 46 minutes and 30 seconds`	6.0M
#25. netmous3 Level 4	5 — 5 disclosed	`2 days, 16 hours, 4 minutes and 10 seconds`	6.0M
#26. parisk Level 4	3 — 1 disclosed	`0 days, 13 hours, 53 minutes and 5 seconds`	5.5M
#27. twsec Level 2	3 — 3 disclosed	`0 days, 19 hours, 46 minutes and 58 seconds`	5.5M
#28. yashamin Level 2	4 — 0 disclosed	`0 days, 10 hours, 32 minutes and 8 seconds`	4.5M
#29. 0xSaltyHash Level 3	4 — 4 disclosed	`0 days, 15 hours, 12 minutes and 47 seconds`	4.5M
#30. thefawsec Level 2	3 — 3 disclosed	`0 days, 10 hours, 25 minutes and 45 seconds`	4.5M
#31. c3phas Level 4	3 — 3 disclosed	`0 days, 12 hours, 31 minutes and 46 seconds`	4.5M
#32. sumzer0 Level 2	3 — 0 disclosed	`0 days, 23 hours, 4 minutes and 35 seconds`	4.0M
#33. jonlaing Level 2	3 — 2 disclosed	`1 days, 9 hours, 19 minutes and 42 seconds`	3.5M
#34. humboldtux Level 3	2 — 0 disclosed	`0 days, 4 hours, 15 minutes and 35 seconds`	3.5M
#35. ribersec Level 3	2 — 0 disclosed	`0 days, 10 hours, 48 minutes and 35 seconds`	3.0M
#36. egryan1 Level 2	3 — 0 disclosed	`0 days, 21 hours, 37 minutes and 50 seconds`	3.0M
#37. YouGina Level 3	2 — 2 disclosed	`0 days, 1 hours, 45 minutes and 18 seconds`	2.5M
#38. xgxtr Level 2	2 — 0 disclosed	`0 days, 3 hours, 1 minutes and 51 seconds`	2.0M
#39. iamvictorteh Level 6	1 — 0 disclosed	`1 days, 7 hours, 32 minutes and 30 seconds`	1.0M
#40. sehno Level 3	1 — 0 disclosed	`0 days, 5 hours, 4 minutes and 22 seconds`	1.0M
#41. flag_c0 Level 5	1 — 0 disclosed	`0 days, 22 hours, 25 minutes and 27 seconds`	500K
#42. tyrox Level 2	1 — 0 disclosed	`0 days, 10 hours, 15 minutes and 35 seconds`	500K

FirstBlood Bugs

Description	Type	Found By
There is an open url redirect vulnerability on /logout.php. The code expects it to start with / and does not allow to redirect to external domains but this can be bypassed.	`Open Redirect`	38
The parameter "goto" is vulnerable to XSS on login.php. The web application makes use of a WAF but this can be bypassed as it's only looking for certain HTML tags and event handlers. It is also vulnerable to open redirect but XSS is the intended bug.	`Reflective XSS`	16
The parameter "ref" is vulnerable to XSS on login.php. The developer has tried to prevent a malicious actor from redirecting to a javascript URI but the attempt to stop this was poor and thus it can be bypassed.	`Reflective XSS`	11
The parameter "ref" is vulnerable to XSS on register.php. The developer made use of htmlentities but this is inadequate as the HREF is wrapped in single quotes.	`Reflective XSS`	7
The endpoint QA.php (to query for an appointment) will allow for integer values to be used when querying for appointments. A bad cause of security through obscurity was attempted.	`Insecure direct object reference`	15
The endpoint MA.php (to modify an appointment) will allow for integer values to be used when modifying appointments. A bad cause of security through obscurity was attempted.	`Insecure direct object reference`	16
The endpoint MA.php (to modify an appointment) only allows for certain values to be modified, however due to some application logic error, if the user has tried to signup as a doctor and has the cookie "doctorAuthed" set, then it allows them to modify the email address for any appointment.	`Application/Business Logic`	17
When cancelling an appointment, an attacker can add a malicious XSS payload that will execute against administrators/doctors	`Stored XSS`	13
When cancelling an appointment, an attacker can add a malicious XSS payload that will execute on manageappointment. Any user (non authed) can view this and will be affected.	`Stored XSS`	4
When creating an appointment, it is possible to get stored XSS /drapi/query.php via the patients name	`Stored XSS`	25
Administrator endpoints can be accessed by non privileged doctor accounts which reveals sensitive patient information.	`Application/Business Logic`	31
If the request method is changed from POST to GET, then the endpoint /drapi/qp.php becomes available to ANY user due to an application logic error	`Auth issues`	18
/attendees/event can be seen on the HackerBack.html page but has a blank response. Upon further inspection and from making use of the web app, you will notice you can add certain headers in order to interact with this endpoint. An old event ID leaks PII information about attendees.	`Information leak/disclosure`	26
The parameter "goto" is vulnerable to XSS on login.php. The web application fails to filter the javascript URI upon redirecting	`Reflective XSS`	3
A doctors invite code is leaked on the internet which if used grants anyone access to the doctor portal. The invite code should expire after use.	`Auth issues`	26
The parameter "ref" is vulnerable to XSS on register.php. The developers failed to filter javascript: when used on "return to previous page"	`Reflective XSS`	5
Unintended: An account with the same username can be created which leads to the original account being deleted and replaced with the attackers	`Auth issues`	9

BugBountyHunter

FirstBlood Scope & Policy

Hacker Leaderboard

Disclosed Reports
SPOILER!

FirstBlood Bugs
SPOILER!

Event Winner

HolyBugx
16 bugs discovered

Scope: 'FirstBloodHackers' (version 1.0)

Available functionality

Credentials available

holybugx

Level 5

jtcsec

Level 4

0xblackbird

Level 5

FirstBlood Bugs

BugBountyHunter

FirstBlood Scope & Policy

Hacker Leaderboard

Disclosed Reports SPOILER!

FirstBlood BugsSPOILER!

Event Winner

HolyBugx 16 bugs discovered

Scope: 'FirstBloodHackers' (version 1.0)

Available functionality

Credentials available

holybugx

Level 5

jtcsec

Level 4

0xblackbird

Level 5

FirstBlood Bugs

Disclosed Reports
SPOILER!

FirstBlood Bugs
SPOILER!

HolyBugx
16 bugs discovered