Infosec Institute

Open Bug Bounty mentioned in the
Top 6 Bug Bounty programs of
2022 by the InfoSec Institute

The Hacker News

Open Bug Bounty named among the
Top 5 Bug Bounty programs of 2021
by The Hacker News

Platform update: please use our new authentication mechanism to securely use the Open Bug Bounty Platform.
For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,710,053 coordinated disclosures
1,386,214 fixed vulnerabilities
1,998 bug bounty programs, 3,899 websites
47,734 researchers, 1,654 honor badges

Contacts+ Bug Bounty Program

Contacts+ runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Contacts+

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Contacts+ and researchers.

Bug bounty program allow private submissions only.

Bug Bounty Scope

The following websites are within the scope of the program:

contactsplus.com

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

If you are a Security Researcher, please let us know about any security issue and we’ll make every effort to quickly correct it. However you must follow our responsible disclosure policy:

- Disclose the vulnerability and all known details promptly.

- Give us a reasonable time to respond to the issue before making any information about it public in order to protect our users from a possible malicious attack in response to your disclosure. You’re more than welcome to post a write-up after the issue has been fixed and public disclosure has been agreed upon.

- Limit the scope of your activities to Contacts+ properties not those belonging to other services we may use such as analytics providers or support helpdesk. Those issues should be reported to the providers directly. If you’re unsure how to proceed please contact us!

- Clickjacking or other forms of deceit are not in scope for our marketing website (www.contactsplus.com) but are in scope for our web app (app.contactsplus.com).

Testing Requirements:

Please do not run any sort of load testing (e.g. DDoS attacks tests) on any of our assets

Act in good faith not to degrade the performance of our services (including denial of service). We understand accidents may happen.
Strive not to access or modify information in users’ accounts should you find a vulnerability. If necessary, please create a second account to demonstrate the issue. If you cannot, you may report using real accounts.

Possible Awards:

Bounties are assigned entirely at the discretion of the Contacts+’s security team.

Valid reports are classified be severity - low, medium and high.
Low severity items are not eligible for a reward.

Medium and High severity items will be rewarded at the discretion of the Contacts+ security team only, on a per case basis.

Special Notes:

We do not wish to receive reports about the following topics:
1. Possible DoS vulnerabilities
2. Email protections (SPF, DKIM, DMARC)
3. Attackers creating accounts using victim's email address, unless you can show POC for data-leak or account-takeover
4. Clickjacking (and other forms of deceit) are not in scope for our marketing website - www.contactsplus.com, but are in scope for our web app - app.contactsplus.com
5. Ability to view our backend's load-balancer IP address, unless you can demonstrate a valid attack vector using it (e.g. via SSRF)
6. Visibility into specific tools versions we may be using (e.g. nginx version), unless you can demonstrate an attack vector.

False reports:
1. Password change policy - we WILL ask for re-authentication before changing the password if a certain number of minutes passed since last authentication
2. Wrong password attempts limitation - please test with valid passwords only, invalid password (e.g. short passwords) do not count against the quota
3. CORS attack using a Contacts+ controlled subdomain (e.g. anything.contactsplus.com)
4. Geolocation/EXIF not stripped from uploaded images
5. Re-authenticate before deleting account - we WILL ask for re-authentication before deleting an account if a certain number of minutes passed since last authentication
6. Session invalidate on password change - Contacts+ will invalidate other sessions, but there might be a few minutes of delay
7. Blog related issues (e.g. seeing blog post authors list)
8. Using Email+password and then using SSO to login to the same account for account takeover - when SSO is used on an existing account for the first time the system will reset the password preventing this scenario
9. Firebase api key can be viewed publicly in our code (please read this: https://firebase.google.com/docs/projects/api-keys)
10. A non-admin can export all contacts from a shared address-book (intentional)
11. Rate-limits / DoS protection / memory attack - our APIs rate limits are very high to support certain user flows on purpose, for most of our APIs reaching the rate limit and getting blocked will not work for a single machine running Burp, but will protect against a botnet army.
12. SSL/TLS versions, unless you can demonstrate an attack.

*** Entering contacts+ website to some public security analyzer site and sending us the report does not count as investing time and will not be considered for a bounty ***

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

Manojkhd     16 February, 2021
    Manojkhd:
Hi, Contacts+’s security team would like info about other type missing and other type implements for website, so where are reporting. please DM me thank you.

  Latest Patched

 17.05.2024 onlinecasinoreports.am
 17.05.2024 aula.sanmartin.edu.co
 17.05.2024 lexton.ws
 17.05.2024 travelmalaysia.me
 17.05.2024 jaspercountysc.gov
 17.05.2024 royaltaxi.me
 17.05.2024 scbacademy.edu.in
 17.05.2024 revizorskotijelo.me
 17.05.2024 taratrans.me

  Latest Blog Posts

04.12.2023 by BAx99x
Unmasking the Power of Cross-Site Scripting (XSS): Types, Exploitation, Detection, and Tools
04.12.2023 by a13h1_
$1120: ATO Bug in Twitter’s
04.12.2023 by ClumsyLulz
How I found a Zero Day in W3 Schools
04.12.2023 by 24bkdoor
Hack the Web like a Pirate: Identifying Vulnerabilities with Style
04.12.2023 by 24bkdoor
Navigating the Bounty Seas with Open Bug Bounty

  Recent Recommendations

    14 May, 2024
    TheDevinSwan:
Thank you for reporting vulnerabilities on our site. Your prompt assistance enabled us to resolve the issue quickly.
    1 May, 2024
    Mek:
Got a recommendation to fix an SQL injection vulnerability on my website. As I am a hobbyist and my page is a hobby project, I can't offer money, so I am recommending this researcher. Thanks again.
    26 April, 2024
    I_bims_Mike:
Thank you very much for identifying the XSS vulnerability and for our friendly email exchange.
    22 April, 2024
    genoverband:
Thank you for your invaluable help in ensuring the security of our domain and its visitors!
    10 April, 2024
    Mars:
Hatim uncovered a XSS bug that we were able to quickly resolve. Thanks very much for your assistance and help.