Zenya / Infoland bug bounty programs

Out of scope 17

Don't test these. A program can exclude a host another program covers; the program you report to decides.

• Anonymous access to the Zenya API (by design)

• Clickjacking, vulnerabilities that can only be exploited through clickjacking

• Cosmetical level issues, i.e. this does not look good in browser A.

• E-mail addresses found at a third party data breach

• HTTP 404 codes/pages or other HTTP non-200 codes/pages and content spoofing/text injections in these pages

• Incomplete or missing SPF, DKIM or DMARC records

• Missing security headers, options and flags

• Outdated versions without proof-of-concept or working exploit

• Public files or directories that do not contain confidential information

• Rate-limiting with no apparent impact

• Registered public IP addresses

• Resource exhaustion / (Distributed) Denial of Service.

• Services running at third party service providers (verify their responsible disclosure statement on beforehand)

• Simple fingerprinting or version listings on OS, services or ports

• Situations that cannot be reproduced; Exploits that are not validated with a second tool/method, i.e. wrong result in tool A, right result in tool B

• TLS misconfiguration without a proof of concept to exploit the weakness

• URL redirection (to a valid webpage)