Infosec Institute

Open Bug Bounty mentioned in the
Top 6 Bug Bounty programs of
2022 by the InfoSec Institute

The Hacker News

Open Bug Bounty named among the
Top 5 Bug Bounty programs of 2021
by The Hacker News

Platform update: please use our new authentication mechanism to securely use the Open Bug Bounty Platform.
For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,722,269 coordinated disclosures
1,392,948 fixed vulnerabilities
2,014 bug bounty programs, 3,932 websites
48,643 researchers, 1,658 honor badges

Conny64 Bug Bounty Program

Conny64 runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Conny64

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Conny64 and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

hennweb.de

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

- always send a working PoC with CVSS score
- attach screenshots
- provide brief remediation guidelines
I am a private person and run my homepage only as a hobby. Since I am not so familiar with the whole technology, I ask for help if there are any security problems. Unfortunately I can't invest a lot of money, but I hope that people will help me anyway.
Many thanks in advance

Testing Requirements:

- restriction to use vulnerability scanners
- focus on /e-commerce and /shop URLs
- don’t test during weekends
I am a private person and run my homepage only as a hobby. Since I am not so familiar with the whole technology, I ask for help if there are any security problems. Unfortunately I can't invest a lot of money, but I hope that people will help me anyway.
Many thanks in advance

Possible Awards:

- recommendation in researcher's profile
- mention in a Hall of Fame or something more valuable proportional to the researcher's efforts
- up to $5 for critical findings
- up to $2.5 for high-risk findings
I am a private person and run my homepage only as a hobby. Since I am not so familiar with the whole technology, I ask for help if there are any security problems. Unfortunately I can't invest a lot of money, but I hope that people will help me anyway.
Many thanks in advance

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 16.06.2024 portal.uoalhuda.edu.iq
 16.06.2024 evdekal.odu.edu.tr
 16.06.2024 dkdp.uobasrah.edu.iq
 16.06.2024 dprc.uobasrah.edu.iq
 16.06.2024 units.uoalhuda.edu.iq
 16.06.2024 users.uoalhuda.edu.iq
 16.06.2024 en.msc.uobasrah.edu.iq
 16.06.2024 deps.uoalhuda.edu.iq

  Latest Blog Posts

04.12.2023 by BAx99x
Unmasking the Power of Cross-Site Scripting (XSS): Types, Exploitation, Detection, and Tools
04.12.2023 by a13h1_
$1120: ATO Bug in Twitter’s
04.12.2023 by ClumsyLulz
How I found a Zero Day in W3 Schools
04.12.2023 by 24bkdoor
Hack the Web like a Pirate: Identifying Vulnerabilities with Style
04.12.2023 by 24bkdoor
Navigating the Bounty Seas with Open Bug Bounty

  Recent Recommendations

    4 June, 2024
    ThirdDoorMedia:
Researcher reported public Docker local env file, no security breach but this file should not be publicly available, thanks SYPltd.
    4 June, 2024
    ThirdDoorMedia:
Researcher reported public local env Docker file, no security breach but file should not be publicly available, thank you SYPltd.
    29 May, 2024
    jraymond:
It was the first time for us that we received a report about openbugbounty. The researcher reported a demo dockerfile on our website. No security breach but it's not "professionnal" to see this kind of file on a website.
Thank you SYPltd
    28 May, 2024
    MotionTM:
Thank you very much for your support and uncovering the vulnerabilities.
    28 May, 2024
    MotionTM:
Thank you very much for your support and uncovering the vulnerabilities.