HackenProof Disclosed Report

Hi HackenProof Team,

I hope you’re doing well! While exploring the Bio section on the HackenProof platform, I noticed a way to bypass your external link warning mechanism. I understand that open redirects are listed as out of scope, but I believe this specific case is worth sharing as it affects user safety and could be abused for phishing or malicious file delivery/download

Vulnerability Overview

In the Bio section, users can write in Markdown. When inserting a normal link, such as:

[Link text](https://dashboard.hackenproof.com/redirect?url=https://example.com)

…it is correctly converted to:

https://dashboard.hackenproof.com/redirect?url=https://dashboard.hackenproof.com/redirect?url=https://example.com

When clicked, this triggers the "Attention! You’re leaving HackenProof" warning screen — a good safety measure to inform users before they navigate away.

⚠️ The Bypass

However, the warning can be bypassed using a Markdown image link. For example:

[![Click Here](https://dashboard.hackenproof.com/redirect?url=https://www.example.png)](https://www.evil.com)

In this case:

• The preview broken image is loaded from the HackenProof redirect endpoint.
• When a user clicks , they are taken directly to https://www.evil.com without the warning page appearing.

💡 Why This Matters

• Attackers could use this to make malicious links appear trustworthy by leveraging the HackenProof domain.
• Users might be tricked into downloading malicious files, opening phishing sites, or visiting other unsafe resources without realizing they’ve left HackenProof.
• The bypass undermines the intended safety feature.

🛠 Suggested Fix

• Sanitize Markdown to ensure that links inside image tags also go through the redirect warning flow.
• Alternatively, block clickable images from linking to external URLs or wrap them in the same verification step.

Please Read The analyst .This is Bypass of the direct Open Redirect Thanks For Understaning

I’m sharing this in the spirit of improving the platform’s user safety. I know this may fall outside the official bounty scope, but I think fixing it will help maintain user trust.

Best regards, unixtz

📎 Proof of Concept

1. Edit your Bio.
2. Insert the Markdown:

[![Click Here](https://dashboard.hackenproof.com/redirect?url=https://www.example.png)](https://www.evil.com)

3. Save the Bio and view your profile.
4. Clicking the image takes you directly to https://www.evil.com without the warning popup.