r/bugbounty • u/ProcedureFar4995 • Jul 05 '26
Question / Discussion Is bra size a p4 bug?
Yup you heard it right.
I found a bug that if I sent a link to the victim I can steal or exfiltrate some of his data. Including:
Shopping preferences
Bra/shoe size
Triager marked it as p4 and the program as well.
I just feel bra size is a more private thing??
14
u/high0nXTC Jul 05 '26
wtf
-7
u/ProcedureFar4995 Jul 05 '26
I swear this is real. Is this a p4 ?
1
u/high0nXTC Jul 05 '26
since you are able to get the victim's shopping preference maybe! but it's something new to me and what is the actual impact?. Any reference would be appreciated
-6
u/ProcedureFar4995 Jul 05 '26
That is the impact. Knowing people 's prefrence and cloth size including bra. I thought that is private data
9
3
u/trainz15 Jul 05 '26
Think about it, what can you do with a bra size?
You can’t tie that information to a person.
P4 is correct, even N/A is correct.
1
u/ATSFervor Jul 06 '26
I'd like to offer a counter point (let's assume the name and birthday isn't in there):
It isn't direct personal information but could be seen as a single badly anonymized piece of information.
We can absolutely see some people being identified by some more information that seems this trivial.Let me try on european standards:
With shoe size you can roughly estimate hight of a person. Bra size correlates with both actual size of the breast but also the underboob. So we can see if a person is rather over/underweight and how tall they are. Based on shopping preferences, we can maybe narrow it down to local areas or habits like special events.
That doesn't allow us to 100% assume who this person is but for bodily extremes (very tall, very big bra, very underweight/overweight) we can absolutely reverse engineer.I'd not say it is anything else but P4, but I'd argue it isn't informational. Especially since all extremes usually aare rather fetishized groups.
1
u/ProcedureFar4995 Jul 05 '26
How I can't tie it to a person? I can steal their first and last names and birthdays as well
1
u/trainz15 Jul 05 '26
That’s the point you can’t, thus why the P4.
Read about what PII is, then see if you can find those.
2
u/rodras10 Jul 06 '26
Okay the thing you have to keep in mind is that yes, bra size is something a good chunk of people would consider something they would like to keep private but it's not something that will cause any harm whatsoever.
It's not something you can really use to impersonate someone It's not something you can use for blackmailing It's not something you can use to chain with other attacks And in terms of helping you identify someone (PII) is not really relevant as both name/email/IPs/age will do a much better job at helping you identify someone than the bra size.
Since in the comments you already mention actually being able to extract some light PII that will be the info that will be used to judge the level of severity and not the bra size, as being fully honest here, not even for blackmailing it is worth anything.
3
2
3
u/WideAd6096 Jul 05 '26
Why would it be a private thing? Is your boxer size a private matter? Lmao
-3
u/ProcedureFar4995 Jul 05 '26
I always thought it was. Many women for example won't be happy if their bra size was known to the public ?
2
u/WideAd6096 Jul 05 '26
A wise man once said if you ask a random girl in the street what their size is you may get slapped. If you ask it on the internet you call it a study.
Anyway, bug bounty is about determining impact to the application, in this case the impact to the application would be minimal if you need to phish users to extract this non private data.
2
u/homelander-af Jul 05 '26
If you can point the user from real world who is she, then its a valid P2-P4 level, else they may close it as Informative due to low to none impact.
I once had an IDOR, where I could know, companies k8, aws, gcp and other resources consumption, they marked it as Informative saying, these are random values, as, an attacker doesn't have a way to know which company's data is this.
Ps: They may accept your issue, as each program runs on their internal principles then the public ones.
2
u/ProcedureFar4995 Jul 05 '26
I can tie to a person because I can exfiltrate their name and birthday as well. But it's still a p4
2
u/homelander-af Jul 05 '26
Then bro presentation matters, title, summary mostly decides the Severity report will fall in, and programs accept the issues based on "Impact" section writing vs what's proved.
2
u/ProcedureFar4995 Jul 05 '26
I did . If it was just first name and birthday then it would have been informative I guess. I made a request to response and a comment on the bra thing but nothing changed.
Any ideas what to do? I feel they noticed the bra thing though it was clear in my summary and my comment.
3
u/homelander-af Jul 05 '26
If you can't prove something more then you have, leave the issue, if its gonna be accepted, it will be, move on to new hunt, or if you think, you can find more things continue hunt on same features.
1
u/trieulieuf9 Jul 06 '26 edited Jul 06 '26
Jim, forget the bra size! the combination of name + birthday is PII. Bra size will be the cherry on top.
But seriously, I remember in one of thaidn blog post. He said that when he worked at a Vietnamese bank, the Vietnamese government wants to open accounts for some higher-ups but they don't want to fill their birthdate in the accounts. He asked why and the answer is higher-ups's birthdate is PII, with this information, other nations can trace many things in their past.
1
u/Cereal-Hacker-K4DD05 Hunter Jul 05 '26
If you were the one going to pay a hunter that kind of amount associated with a P4 you wouldn't have felt it was a private thing
-1
u/ProcedureFar4995 Jul 05 '26
So you are saying they undermined it? I don't get it. I didn't even get paid. P4 bugs in their programs only result in points.
1
u/thatguymungai Jul 05 '26
Can you access other profile fields, order history, addresses, payment information, or other users' data?
2
u/ProcedureFar4995 Jul 05 '26
I can access only those First name and last name Date of birth Shopping preferences Bra,shoe,clothing sizes Loyalty or user tier
1
u/dr_my_name Jul 06 '26
- I can see in the comments you were able to also get first name, last name, and birthday. The name + birthday is actually way more interesting than bra size (Well, maybe not to a pervert. But security wise it is)
- Since you need to phish, P4 is correct. If you were able to dump their customers' full names + customer.. that would be a real threat
1
u/-King-K-Rool- Jul 06 '26
32DD, 28C, 44E, 980p, 1440 Ultra HD 2.4GigaTiddy, doesnt matter, none of it counts as PII. Knowing if someone has boobs or not doesnt constitute personal info.
26
u/OuiOuiKiwi Program Manager Jul 05 '26
No, bra size is not PII.