# Hogging up all the resources on hackerone.com

Adding ~800 zero-value bounty activities to a HackerOne report made its JSON endpoint slow enough that 10 parallel requests could DoS the site.

- Payout: hidden
- Severity: medium
- Program: HackerOne
- Found by: kirils
- Disclosed: 2019-04-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/125587
- Library page: https://bugbountylibrary.com/r/h1%3A125587
- Tags: area:web domain:web impact:dos kind:bounty platform:hackerone sev:medium technique:race-window vuln:business-logic vuln:dos

**Target:** hackerone.com report JSON endpoint /reports/NNNNNN.json and /reports/bulk
**Root cause:** Each Activities::BountyAwarded entry on a report adds unoptimized processing cost to the report JSON serialization, so many activities make the endpoint take >30s and Cloudflare drops the session; the bulk endpoint also lacks replay protection.
**Steps:**
1. Award a bounty of `0.001` to a report (passes the >0 filter, effectively zero).
2. Repeat via POST to `https://hackerone.com/reports/bulk` (replayable, no use-once token) until ~800 Activities::BountyAwarded exist.
3. Observe `/reports/NNNNNN.json` load time grow with activity count (335→13s, 750→28s).
4. At ~800 activities the response exceeds Cloudflare's 30s limit and the session is disconnected.
5. Run `for((x=0;x<10;x++)); do (curl https://hackerone.com/reports/NNNNNN.json & ); done` to saturate the backend.
**How found:** Measured JSON load time as activity count grew and noticed linear slowdown; correlated with Cloudflare's 30s disconnect to reach an availability threshold, then tested parallel requests.
**Exploitation:** Attacker with bounty-awarding rights (or via replayed bulk POST) inflates a public report with hundreds of near-zero bounty activities, making its JSON endpoint exceed Cloudflare's 30s timeout; then 10 parallel curl requests to that JSON repeatedly take the site down, achievable with ~14k requests/day.
**Escalation:** Chained zero-bounty filter bypass + replayable bulk POST to cheaply mass-create activities, then amplified via Cloudflare timeout and parallel requests into site-wide DoS.
**Insight:** Serialization cost that scales with user-controllable child records (activities, comments, awards) is a DoS primitive; look for endpoints where an attacker can cheaply create many sub-objects and measure response time growth.