PlanetHoster Bug Bounty

Description

PlanetHoster offers premium Web Hosting Solutions: Shared Hosting World Platform, Reseller solution Multi-World and Dedicated Server HybridCloud. No technology is perfect, and PlanetHoster believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Any domain/property of PlanetHoster not listed in the targets section is out of scope. This includes any/all subdomains not listed above. Access/Credentials Each researcher will be given one test account. Please do not change your test email address as this would put you out of compliance with our program. This will be verified during report submission. To obtain credentials, scroll to the bottom of this brief and click the Get Credentials button. Account Credit The accounts are pre-loaded with €100 of credit to test purchasing and payments on the PlanetHoster platform. You should be supplied with enough credit to fully test the web application, but if you need more credit, please reach out to Bugcrowd Support with your reason for needing additional credit. Navigating to world.planethoster.net Get Your Login Details: Log in to your https://my.planethoster.net account and navigate to My Services and select "WORLD" under Product/Service . Log Into world.planethoster.net: navigate to https://world.planethoster.net and input your provided credentials. Whitelist IP for API Access Once signed into the PlanetHoster web portal, to use the API, please whitelist your IP here: Domain Reseller API - Account Info page Once you have access the page a support ticket must be opened (Located at the top right of the page). The ticket details should state the following: Subject: Whitelist IP for API testing Question: I am testing on behalf of the Bugcrowd bug bounty program and am requesting that my IP [PROVIDE IP ADDRESS HERE] is whitelisted for API testing. Once the ticket is reviewed and approved you will be able to access to use the PlanetHoster API. Focus Areas Domain Names, DNS Management, Order form Access to other users' accounts / information Information that should not be available User passwords World hosting panel Out-of-Scope Any type of DDoS or DoS attacks - remember you are testing on production Automated testing on Support channels

In Scope (in scope)

API Documentation & Setup PlanetHoster API Docs Base URLs for PlanetHoster's Rest APIs Domain API - https://api.planethoster.net/reseller-api/ World API - https://api.planethoster.net/world-api/