Just found an XSS in Habbo, what to do?

[noobdoob]

Hey guys, I just found an XSS in Habbo, it's persistent. I've reported it to Habbo but as always there is no reply. I'm wondering what to do?

If you're wondering what this is: XSS is a cross site script, I can basically upload anything to that page. A java driveby a HTML deface page or anything else.

I think I might end up selling this.

What are your thoughts?

Thread moved here by Martin (Forum Moderator): From 'Habbo In General' as its more suited here.

[Michael]

Um. If only that made sense..

[Samantha]

If you reported it to Habbo why the hell would you sell it? Surely you'd get in trouble because of distribution.

Maybe be patient with Habbo mods, expect a delay.

[xxMATTGxx]

When did you report it? You could always tweet them and ask if there is a way to contact them directly.

http://www.sulake.com/contact/sulake-tweeters/

[Mark]

I've not got a clue what this means, can you give us a more detailed example?

[Recursion]

Even if you did find one, posting on this forum and then selling it is going to get you in a whole load of legal trouble (I'm sure Habbox would love to help Sulake in tracking you down). E-Mail them and forget about it.

[auffant1]

All I heard was script, java and sell. Me no understand :S

[GoldenMerc]

Tweet it to Paul, or just let it die. Legal battles with multi million / billion companys would not go down well on a cv

[Breeze]

An XSS exploit can allow one to steal Habbo accounts and gain user information when used right this is. If I'm not mistaken this stuff is pretty lethal, I've recently look at "HF" (keeping it short to not cause a stir) and you're from there I think, you'll get into some deep issues if you try and sell this, personally I'd use it until they patch it or bribe them with it, for example: "I'll tell you the new XSS exploit in exchange for ______" if they ask for the information first just say to them that if you aren't given what you want you'll use it. I'm not saying cause any issues but be very careful with what you do with it, Habbox does not promote "hacking" so I'd avoid posting it here.

[ngc6611]

i can take care of this.