The Hut Group: Public Managed Bug Bounty Engagement

Description

No technology is perfect and The Hut Group believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web applications, mobile applications and APIs. Good luck, and happy hunting! Ratings/Rewards: For the initial prioritization/rating of findings, this program will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of The Hut Group not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to The Hut Group, please reach out to Bugcrowd Support Portal . We will address your issue as soon as possible. Targets The targets are on several shared platforms. Submissions on a target will be likely valid for other targets on the platform that they share. Any vulnerabilities submitted on a shared platform will be duplicated against the first submission that was made. Rules Do not access customer or employee personal information or confidential information belonging to The Hut Group. If you accidentally access any of these, please stop testing and submit the vulnerability. If you believe you have found sensitive customer data such as login credentials, API keys etc., or a way to access customer data through a vulnerability then report it, but do not attempt to successfully validate it works. If you accidently access sensitive data belonging to customers, employees or The Hut Group, please destroy the data securely and report the details of how this data was obtained. Collect only the information necessary to demonstrate the vulnerability. When investigating a vulnerability, please only target your own test accounts and do not attempt to access data from anyone else’s account. Bounties are given at the discretion of The Hut Group and we withhold the right to modify or deny bounties. We can assure all researchers this will be done fairly. Do NOT conduct attacks such as social engineering, phishing or unauthorized access to infrastructure. Do NOT test the physical security of The Hut Group offices, employees, equipment, etc. Please use a sensible rate limit when running automated scanners, we consider around 5 requests per second sensible. Please include the following headers in all server requests. This allows us to identify researcher testing activity and avoids blocking. X-Request-ID: Bugcrowd Vulnerability reports which do not include manual validation with a proof of concept will be closed as Not Applicable. When duplicates occur, we only award the first report that was received. Multiple vulnerabilities caused by one underlying issue will be awarded one bounty. Multiple similar vulnerabilities against 1 target may be considered as one higher severity “Site-Wide” issue, for example multiple instances of privilege escalation using 1 specific user role on 1 site within scope. Be mindful with the rate and scope of automated scanning tools. Submissions Please be descriptive in your submission's titles and descriptions. Give detailed proofs of concept with actual attack scenarios. Credentials: To gain access to the applications, please sign up for accounts using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here . Focus Areas: We encourage researchers to focus their efforts in the following areas: Exfiltration of Sensitive or Personal Data (Employees and Customers) - When testing for customer data exfiltration, please only use accounts that you own. Do not test on customer data. Business Logic Flaws. Remote Code Execution. SQL and Command Injection. Authentication Bypass. Cross Site Scripting (XSS). Cross Site Request Forgery (CSRF). Insecure Direct Object References. Privilege Escalation. Excluded from Rewards OAUTH pre account take over is a known issue and currently out of scope until further notice. Physical testing. Social engineering. Denial of Service attacks. Subdomain Takeover. Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS. Rate limiting or brute force issues on non-authentication endpoints. On authentication endpoints, THG will determine what is considered acceptable rate limiting. Brute forcing of any accounts not owned by yourself. Mail Server Domain Misconfiguration (including email spoofing, missing DMARC, SPF/DKIM/DMARC, etc.) Internal IP address disclosure. Missing best practices in Content Security Policy. Weak password policies. Presence of application or web browser ‘autocomplete’ or ‘save password’ functionality. Lack of Secure/HTTPOnly flags on non-sensitive Cookies. Self-XSS. Vulnerabilities that are limited to unsupported browsers will not be accepted (i.e. "this exploit only works in IE6/IE7"). Known vulnerabilities in used libraries unless you can prove exploitability. Reports directly from automated tools or scans without a manual Proof of Concept. Reports of insecure SSL/TLS ciphers without a working proof of concept. Social Media Account (Twitter/LinkedIn/Facebook etc.) hijacking via a broken link. Out-of-date software without known vulnerabilities. Use of a known-vulnerable component unless you are able to provide proof of exploitation. Safe Harbor: When conducting vulnerability research according to this policy, we consider this research to be: Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy; Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls; Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and Lawful, helpful to the overall security of the Internet, and conducted in good faith. You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via Bugcrowd Support Portal before going any further.

Ingenuity E-Commerce (in scope)

Targets in this group are sharing the same platform, any valid submissions made will be duplicated against the first submission that was made.