Verisign Bug Bounty

Description

Verisign’s critical yet mostly invisible role – helping to maintain the security, stability and resiliency of the Domain Name System (DNS) and the internet – can sometimes be overshadowed by more visible aspects of the domain name business. The importance of what we do behind the scenes, however, helps the world connect online every day. No technology is perfect, and Verisign believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our assets. Good luck, and happy hunting! Ratings/Rewards For the initial prioritization/rating of findings, this engagement will use the Bugcrowd Vulnerability Rating Taxonomy . However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.

Targets

Testing is only authorized on the targets listed as in scope. Any domain/property of Verisign's not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you believe you've identified a vulnerability on a target that is not in scope, but it demonstrably belongs to Verisign, please reach out to Bugcrowd Support before submitting. Eligible Vulnerabilities within the Targets Cross-site scripting Cross-site request forgery Authentication or authorization flaws Server-side code execution bugs DNS vulnerabilities WHOIS vulnerabilities Local file includes XML external entity processing Server-side request forgery Out of Scope Targets Any Verisign services or systems not specifically listed as an in-scope Target above. Any third-party apps, servers, or websites that integrate with Verisign. These are not managed by Verisign and do not qualify under our guidelines for security testing. Excluded Vulnerability Types Denial of service attacks Username / email enumeration by brute forcing / error messages (e.g. login / signup/ forgotten password) Exceptional cases may still be in scope (e.g. ability to enumerate email addresses via incrementing anumeric parameter) Spamming/social engineering/phishing attacks Includes email spoofing Email spoofing (including SPF, DKIM, From: spoofing, and visually similar, and related issues) Open redirects (through headers and parameters) Lack of security speedbump when leaving the site Accessible Non-sensitive files and directories (e.g. README.TXT, CHANGES.TXT, robots.txt, gitignore, etc.) Fingerprinting/banner disclosure on common/public services Clickjacking and issues only exploitable through clickjacking Lack of Secure and HTTPOnly cookie flags (critical systems may still be in scope) TLS/SSL Issues, including BEAST BREACH, insecure renegotiation, bad cipher suite, expired certificates Verisign Responsible Disclosure Program Terms We appreciate security researchers who help us keep Verisign employees and systems secure by reporting vulnerabilities in our services or infrastructure. Researchers who report such vulnerabilities may receive monetary bounties subject to the terms and conditions outlined below. To qualify for a bounty, researchers must meet the following requirements: You must adhere to our Responsible Disclosure Policy (see below). Your report must address one of the in-scope Targets and must identify an eligible vulnerability (see above). We specifically exclude certain targets as out-of-scope and certain security issues as ineligible (see above). You should provide sufficient proof of the vulnerability, such as a written description of the vulnerability or a screenshot demonstrating its existence. You agree to convey any and all intellectual property rights arising from or relating to each vulnerability you provide under Verisign's Program Brief. If you inadvertently access account data, service configurations, or other confidential information (collectively “Data") while investigating an issue, you are prohibited from saving, storing, transferring or otherwise further accessing any and all such Data after discovery. In turn, we follow these guidelines when evaluating reports under our bug bounty program: We investigate all reports and respond to all reports relating to in-scope targets and eligible vulnerabilities. Due to the volume of reports we receive, we prioritize evaluations based on risk and other factors, and it may take some time before you receive a reply. We determine bounty amounts based on a variety of factors, including (but not limited to) impact, ease of exploitation, and quality of the report. You can find further information in our Rewards Guidelines below. We generally pay similar amounts for similar issues, but bounty amounts and qualifying issues may change over time. Past rewards do not necessarily guarantee similar results in the future. In the event of duplicate reports addressing the same vulnerability, we award a bounty to the first person to report an issue with sufficient proof. We reserve the right to publish reports (and accompanying updates). We may post a list of researchers who have submitted valid security reports. If you receive a bounty for discovery of a vulnerability, you are eligible to be included in this list, but you may opt not to be included if you wish. We reserve the right to limit or modify the information accompanying your name in the list. [Bugcrowd] verifies that all bounty awards are permitted by applicable laws, including (but not limited to) US trade sanctions and economic restrictions. Verisign employees and their immediate family are not eligible to participate. Verisign Responsible Disclosure Policy Verisign expressly authorizes researching and reporting security issues in a manner that complies with the policies below, and, Verisign will not initiate a lawsuit against you or seek any law enforcement investigation against you in response to such authorized research and reports. We require that: You make a good faith effort to avoid privacy violations and disruptions to others. You specifically should avoid unauthorized access to, or destruction of, data and interruption or degradation of our services. You do not exploit a security issue you discover for any reason. Impermissible exploitation includes, but is not limited to, actions intended to demonstrate the potential impact or risk of the vulnerability, such as attempts to compromise sensitive company data or probing for additional issues related to an eligible vulnerability in an in-scope target that exceeds any of the policies addressed here. You do not intentionally violate any applicable laws or regulations, including (but not limited to) laws and regulations prohibiting the unauthorized access to data. You are not authorized to access user data or company data, including (but not limited to) personally identifiable information or other data relating to an identified or identifiable natural person. If you inadvertently access personal or company data while investigating an issue, you are prohibited from saving, storing, transferring or otherwise further accessing any and all such data after discovery.

In Scope Targets - Tier 1 Rewards (in scope)

Rewards Guidelines Verisign may consider a variety of factors when determining the bounty that a researcher should receive for reporting a vulnerability, consistent with the policies identified above. Generally, however, Verisign will follow separate payment scales for vulnerabilities identified with Verisign's DNS and related infrastructure, on the one hand, and Verisign's other in-scope targets, on the other hand. Rewards for qualifying bugs range from $100 to $10,000. The following table outlines the usual rewards chosen for the most common classes of bugs: Vulnerability │ DNS and related infrastructure Remote Code Execution │ $10,000 Logic flaw bugs leaking or bypassing significant security controls │ $5,000 SQL Injection │ $5,000 Stored Cross Site Scripting │ $2,500 Reflected Cross Site Scripting │ $1,250

In Scope Targets - Tier 2 Rewards (in scope)

Rewards Guidelines Verisign may consider a variety of factors when determining the bounty that a researcher should receive for reporting a vulnerability, consistent with the policies identified above. Generally, however, Verisign will follow separate payment scales for vulnerabilities identified with Verisign's non DNS related infrastructure. Rewards for qualifying bugs range from $100 to $5000. The following table outlines the usual rewards chosen for the most common classes of bugs: Vulnerability │ Non-DNS related infrastructure Remote Code Execution │ $5,000 Bypass Security Controls/Logic Flaw │ $2,500 Unrestricted/Arbitrary file access │ $2,500 Stored Cross Site Scripting │ $1,500 XSS (Reflective vs Stored) │ $500 - $1,250