Report a Vulnerability
Submit, help fixing, get kudos.
Start a Bug Bounty
Run your bounty program for free.
541,051 coordinated disclosures
348,089 fixed vulnerabilities
814 bug bounties with 1,591 websites
16,682 researchers, 1133 honor badges

IntoHU Bug Bounty Program

IntoHU runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of IntoHU

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between IntoHU and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

*.into.hu

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Do not attacks in our user base, please use test accounts!

We prefer to use the openbugbounty.org report system, so if the report is possible to send in this platform, please don't send us email!

Testing Requirements:

Please do not use automated security scanners, DDoS testing, destructive security tests or any type of denial of service attack.

You must not disclose, manipulate, extract or destroy any user data or any data to which you have access.

Possible Awards:

Praise and recommendations in your researcher profile for all valid submissions, and if you report a bigger vulnerability, we also can support you via bounty.


We count as a bigger vulnerability:

- Code injections (SQL, HTML, JS, PHP)
- Remote Code Execution
- Authentication or authorization vulnerabilities
- Local files access and manipulation
- Directory Traversal
- Stored XSS
- any other vulnerabilities that provides an opportunity to modify files, data or databases on the server, or provides inadequate access to user profiles or page content.


We appreciate if you find some of those vulnerability, but we cannot able to send bounty for those:
- self-XSS
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies

Please do not report any of those:
- Missing CSRF token in forms, where sensitive information cannot be modified
- Reports from automated scanners
- any other vulnerabilities that works only old browsers / OSes.

Special Notes:

Do not test the subdomain samsoniak .into.hu - this page use a web hosting with a built-in content management system (named uCoz), so we cannot able to fix the vulnerabilities in this site.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

If the report is not possible in the openbugbounty.org website, please send us an email: [email protected]

Please inform us which IP addresses tests are performed from!

General Requirements:

If you find a bug, please inform us within 7 days.

Please do not endanger the proper day-to-day operation of our service!

Testing Requirements:

Please do not use automated security scanners, DDoS testing, destructive security tests or any type of denial of service attack.

You must not disclose, manipulate, extract or destroy any user data, database or any data or file to which you have access.

Physical exploits of our servers or network are not allowed!


Do not exploit or public vulnerabilities that have already been found!

Possible Awards:

Praise and recommendations in your researcher profile for all valid submissions. If you report a bigger vulnerability, we also can support you via gift cards or PayPal.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  How quickly researchers get responses to their submissions.
Remediation Time  How quickly reported submissions are fixed.
Cooperation and Respect  How fairly and respectfully researchers are being treated.

Researcher's comments

    27 June, 2020
    ZerMalkzb:
Thanks for the recommendation in my profile!
The website owner answered me quickly and fixed the vulnerability within 1 day.
    25 June, 2020
    ChampionLeake:
Very fast and very nice!
It was a pleasure working with them to identify a vulnerability on their platform :)

  Latest Patched

 08.07.2020 daniweb.com
 07.07.2020 wikizero.com
 07.07.2020 kayqer.am
 06.07.2020 wirtualnemedia.pl
 06.07.2020 kpl.gov
 05.07.2020 arise.com
 05.07.2020 ica.se
 05.07.2020 oxtorrent.com
 05.07.2020 mrshabanali.com
 05.07.2020 neimanmarcus.com

  Latest Blog Posts

24.06.2020 by Gkexamquiz
How to Find Contacts To Report Bugs & Security Vulnerabilities | Bug Bounty Tutorials 2020
24.06.2020 by 0xcrypto
Improper Access Control - Generic: Unrestricted access to any "connected pack" on docs in coda.io
04.04.2020 by Rando02355205
(Alibaba) message.alibaba.com [IDOR] - [Bug Bounty]
12.03.2020 by Rando02355205
(Paypal) www.paypal.com [CSP High Level] - [XSS Reflected] - [Bug Bounty] - [Write Up]
08.03.2020 by CybeReports
JDECO.net XSS Vulnerability| CybeReports

  Recent Recommendations

    8 July, 2020
     baladulan:
Armin, vielen Dank für deine Unterstützung!
    6 July, 2020
     aldraHastur:
Vielen Dank für den Hinweis, mit dem wir eine Lücke im System schließen konnten.
    4 July, 2020
     TadeuszWiew:
Thank you for finding and reporting the vulnerability on our website.
Great job! :)
    2 July, 2020
     booksprice:
Thank you for reporting the bug, and the clear details, much appreciated.
    1 July, 2020
     matthews8000:
Manish has correctly identified a vulnerability and suggested an appropriate fix. This has lead to an improvement in the security of the website.