Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
492,052 coordinated disclosures
268,540 fixed vulnerabilities
662 bug bounties with 1,340 websites
13,649 researchers, 1033 honor badges

Ferox Hosting Bug Bounty Program

Ferox Hosting runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Ferox Hosting

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Ferox Hosting and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

*.winkel.ferox.host
*.feroxhosting.nl

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

You shall not exploit the vulnerability.
You shall notify the site owner immediately.
livechat is not part of the test. Please report any livechat issues to tawk.to instead

things to keep an eye on:
/blog - wordpress
winkel.ferox.host - payment system, that one is custom so it might have some low hanging fruit.

Last edit: 2 Jan 2020

Testing Requirements:

You should not impact any customers or administrators while testing your exploits.

Possible Awards:

small amounts of Money for high-severity, free services

(keep in mind that we're a really small company. So please don't spend too much time trying to attack/write reports because we wont be able to award you in any useful way)

We will be happy to give a testomonial.

Special Notes:

Please contact us when you think you even have a "possible" exploit

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

email: [email protected]

General Requirements:

dont impact any customers or admins
livechat is not part of the test. Please report any livechat issues to tawk.to instead

Testing Requirements:

dont impact any customers or admins

Possible Awards:

money, free services
(keep in mind that we're a really small company. So please don't spend too much time trying to attack/write reports)

Special Notes:

keep in mind that we're a really small company. So please don't spend too much time trying to attack/write reports

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 21.01.2020 kosmo.com.my
 21.01.2020 grandrapidsmi.gov
 20.01.2020 frandroid.com
 20.01.2020 vanityfair.com
 20.01.2020 utusan.com.my
 20.01.2020 60secondsnow.com
 20.01.2020 zapmeta.ng
 20.01.2020 genyt.net
 20.01.2020 baku.ws
 20.01.2020 cqu.edu.au

  Latest Blog Posts

20.01.2020 by Rando02355205
XSS on "www.alibaba.com" (Alibaba WAF 405) Bypassed.
16.01.2020 by Open Bug Bounty
Brief Recap of Open Bug Bounty’s Record Growth in 2019
12.01.2020 by JCQ_47
WAF Cloudflare Bypass XSS at Nexusmods.com
08.01.2020 by devl00p
Top 100 Open Redirect dorks
08.01.2020 by Rando02355205
XSS WAF Bypassed

  Recent Recommendations

    21 January, 2020
     astroseekcom:
Thank you for report about SQL vulnerability.
    20 January, 2020
     PaulMar23292621:
Miguel showed us several information disclosure issues with our site. Thank you very much Miguel!
    18 January, 2020
     damnitjim:
Thanks for taking the time to report the weaknesses and really appreciate the wapiti tool that you've developed.
    17 January, 2020
     gexsi_search:
Many thanks for your support!
    17 January, 2020
     smay84:
Thank you for your quick response and helpful information.