Subject: Ticket Assigned - Re: BUG REPORT
From: Max <[email-masked]>
To: [email-masked]
Date: Mon, 31 Aug 2020 10:29:13 +0000

Hi Rehan Khan,  A new ticket has been assigned to you. Please follow the link below to view the ticket.  Re: BUG REPORT Hi sir,
Today is my last email .Tomorrow I will publish your all website bug in my
blog for educational purpose.Otherwise i am not responsible for your
website.
Best Regards

On Tue, Nov 12, 2019 at 9:28 AM Noman sarwar <[email-masked]>
wrote:

> Hi Team
> Is there any update on this?
> Its been long time since i have bug reported. Hoping to receive a $100
> bounty for the responsible disclosure of this vulnerability
> Further more i would like to publish this report on my blog for
> educational purposes within a week of this email if there is any objection
> inform me before then.
>
> Best Regards
>
> On Wed, Nov 6, 2019, 3:53 PM Noman sarwar <[email-masked]>
> wrote:
>
>> Hi Team,
>>
>> Is there any update on this?
>>
>> Kind Regards
>>
>> On Sat, Nov 2, 2019, 11:52 AM puja sarwar <[email-masked]>
>> wrote:
>>
>>> Click Jacking
>>>
>>> hi there i have found a clickjacking vulnerability in your site
>>> Clickjacking, also known as a "UI redress attack", is when an attacker
>>> uses multiple transparent or opaque layers to trick a user into clicking on
>>> a button or link on another page when they were intending to click on the
>>> the top level page. Thus, the attacker is "hijacking" clicks meant for
>>> their page and routing them to another page, most likely owned by another
>>> application, domain, or both.
>>> Using a similar technique, keystrokes can also be hijacked. With a
>>> carefully crafted combination of stylesheets, iframes, and text boxes, a
>>> user can be led to believe they are typing in the password to their email
>>> or bank account, but are instead typing into an invisible frame controlled
>>> by the attacker.
>>> PoC:
>>>
>>> <html>
>>>
>>>
>>>
>>> <head>
>>>
>>>
>>>
>>> </head>
>>>
>>>
>>>
>>> <body>
>>>
>>>
>>>
>>> <iframe src="  https://www.maxfashion.com/ae/en/c/men-shoes  ">
>>>
>>>
>>>
>>> </iframe>
>>>
>>>
>>>
>>> </body>
>>>
>>>
>>>
>>> </html>
>>>
>>> MPACTS:
>>> Tricking a user into unknowingly;
>>>
>>> No.1: An attacker can gain access to the credentials of users and use
>>> those credentials for booking and payment.
>>>
>>> No.2: adding events to their profile they are interested in attending.
>>>
>>> No. 3: editing their star rating on reviews;
>>>
>>> No.1: bookmarking unwanted business
>>>
>>> Waiting for your response
>>>
>>>
>>> PROOF:
>>>
>>

 https://landmarkgroupservice.freshdesk.com/helpdesk/tickets/1440916