Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
541,670 coordinated disclosures
348,448 fixed vulnerabilities
816 bug bounties with 1,594 websites
16,709 researchers, 1133 honor badges

Ferox Hosting Bug Bounty Program

Ferox Hosting runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of Ferox Hosting

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between Ferox Hosting and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

*.winkel.ferox.host
*.feroxhosting.nl

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

You shall not exploit the vulnerability.
You shall notify the site owner immediately.
livechat is not part of the test. Please report any livechat issues to tawk.to instead

things to keep an eye on:
/blog - wordpress
winkel.ferox.host - payment system, that one is custom so it might have some low hanging fruit.

Last edit: 2 Jan 2020

Testing Requirements:

You should not impact any customers or administrators while testing your exploits.

Possible Awards:

small amounts of Money for high-severity, free services

(keep in mind that we're a really small company. So please don't spend too much time trying to attack/write reports because we wont be able to award you in any useful way)

We will be happy to give a testomonial.

Special Notes:

Please contact us when you think you even have a "possible" exploit

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

email: [email protected]

General Requirements:

dont impact any customers or admins
livechat is not part of the test. Please report any livechat issues to tawk.to instead

Testing Requirements:

dont impact any customers or admins

Possible Awards:

money, free services
(keep in mind that we're a really small company. So please don't spend too much time trying to attack/write reports)

Special Notes:

keep in mind that we're a really small company. So please don't spend too much time trying to attack/write reports

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

No comments so far.

  Latest Patched

 09.07.2020 grin.com
 09.07.2020 gettyimages.fr
 09.07.2020 kiplinger.com
 09.07.2020 penzance-tc.gov.uk
 09.07.2020 eszkola.pl
 09.07.2020 rid.ncifcrf.gov
 09.07.2020 nu.or.id
 09.07.2020 gamebanana.com
 09.07.2020 medcn.cn
 09.07.2020 shehabnews.com

  Latest Blog Posts

24.06.2020 by Gkexamquiz
How to Find Contacts To Report Bugs & Security Vulnerabilities | Bug Bounty Tutorials 2020
24.06.2020 by 0xcrypto
Improper Access Control - Generic: Unrestricted access to any "connected pack" on docs in coda.io
04.04.2020 by Rando02355205
(Alibaba) message.alibaba.com [IDOR] - [Bug Bounty]
12.03.2020 by Rando02355205
(Paypal) www.paypal.com [CSP High Level] - [XSS Reflected] - [Bug Bounty] - [Write Up]
08.03.2020 by CybeReports
JDECO.net XSS Vulnerability| CybeReports

  Recent Recommendations

    9 July, 2020
     newstroll_de:
Thanks for reporting the bug in a very professional manner. We appreciate your work that helps us making our service more secure.
    9 July, 2020
     MariStep2:
Great job! :) Thank you for searching for vulnerabilities on our site. Very responsive, attentive and responsible Security Researcher.
    8 July, 2020
     ziduniwien:
Dear Tanzil,

The University of Vienna would like to thank you for your valuable contribution in finding multiple website security issues.
Your input is highly welcome and helps to raise the security level of our educational institution.

Servus and greetings from Vienna, Austria.
    8 July, 2020
     baladulan:
Armin, vielen Dank für deine Unterstützung!
    6 July, 2020
     aldraHastur:
Vielen Dank für den Hinweis, mit dem wir eine Lücke im System schließen konnten.