Open Bug Bounty selected among the
Top 5 Bug Bounty programs to watch
in 2021 by The Hacker News

For security researchers
Report a Vulnerability
Submit, help fixing, get kudos.
For website owners
Start a Bug Bounty
Run your bounty program for free.
1,006,104 coordinated disclosures
628,908 fixed vulnerabilities
1,348 bug bounty programs, 2,698 websites
23,362 researchers, 1,318 honor badges

IntoHU Bug Bounty Program

IntoHU runs a bug bounty program to ensure the highest security and privacy of its websites. Everyone is eligible to participate in the program subject to the below-mentioned conditions and requirements of IntoHU

Open Bug Bounty performs triage and verification of the submissions. However, we never intervene to the further process of vulnerability remediation and disclosure between IntoHU and researchers.

Bug bounty program allow private and public submissions.

Bug Bounty Scope

The following websites are within the scope of the program:

*.into.hu

Non-Intrusive Submissions Handling

The following section encompasses submission of the vulnerabilities that do not require intrusive testing as per Open Bug Bounty rules:

- Cross Site Scripting (XSS)
- Open Redirect

- Cross Site Request Forgery (CSRF)
- Improper Access Control

General Requirements:

Do not attacks in our user base, please use test accounts!

We prefer to use the openbugbounty.org report system, so if the report is possible to send in this platform, please DO NOT send us email!

Testing Requirements:

Please do not use automated security scanners, DDoS testing, destructive security tests or any type of denial of service attack.

You must not disclose, manipulate, extract or destroy any user data or any data to which you have access.

Possible Awards:

Praise and recommendations in your researcher profile for all valid submissions.


We count as a bigger vulnerability:

- Code injections (SQL, HTML, JS, PHP)
- Remote Code Execution
- Authentication or authorization vulnerabilities
- Local files access and manipulation
- Directory Traversal
- Stored XSS
- any other vulnerabilities that provides an opportunity to modify files, data or databases on the server, or provides inadequate access to user profiles or page content.


We appreciate if you find some of those vulnerability, but we cannot able to send bounty for those:
- self-XSS
- Missing "HttpOnly", "secure", "SameSite" flags for non-sensitive cookies

Please do not report any of those:
- Missing CSRF token in forms, where sensitive information cannot be modified
- Reports from automated scanners
- any other vulnerabilities that works only old browsers / OSes.

Special Notes:

Do not test the subdomain samsoniak .into.hu - this page use a web hosting with a built-in content management system (named uCoz), so we cannot able to fix the vulnerabilities in this site.

Other Submissions Handling

Website owner want to receive information about other vulnerabilities

Notifications:

If the report is not possible in the openbugbounty.org website, please send us an email: [email protected]

We prefer to use the openbugbounty.org report system, so if the report is possible to send in this platform, please DO NOT send us email!

Please inform us which IP addresses tests are performed from!

General Requirements:

If you find a bug, please inform us within 7 days.

Please do not endanger the proper day-to-day operation of our service!

Testing Requirements:

Please do not use automated security scanners, DDoS testing, destructive security tests or any type of denial of service attack.

You must not disclose, manipulate, extract or destroy any user data, database or any data or file to which you have access.

Physical exploits of our servers or network are not allowed!


Do not exploit or public vulnerabilities that have already been found!

Possible Awards:

Praise and recommendations in your researcher profile for all valid submissions.

Community Rating

Provided by security researchers who reported security vulnerabilities via this bug bounty program:

 
Response Time  Information How quickly researchers get responses to their submissions.
Remediation Time  Information How quickly reported submissions are fixed.
Cooperation and Respect  Information How fairly and respectfully researchers are being treated.

Researcher's comments

ZerMalkzb     27 June, 2020
    ZerMalkzb:
Thanks for the recommendation in my profile!
The website owner answered me quickly and fixed the vulnerability within 1 day.
ChampionLeake     25 June, 2020
    ChampionLeake:
Very fast and very nice!
It was a pleasure working with them to identify a vulnerability on their platform :)

  Latest Patched

 21.06.2021 govtech.com
 20.06.2021 gdrfad.gov.ae
 20.06.2021 realcommercial.com.au
 20.06.2021 allofustec.nnlm.gov
 19.06.2021 getchu.com
 19.06.2021 explorelearning.com
 19.06.2021 fibre2fashion.com
 19.06.2021 tme.eu
 18.06.2021 www1.caixa.gov.br
 18.06.2021 butantan.gov.br

  Latest Blog Posts

25.05.2021 by 0xrocky
Google XSS Game
25.05.2021 by ShivanshMalik12
Testing for XSS (Cross Site Scripting)
25.05.2021 by darklotuskdb
Easy XSS On Mostly Educational Websites Via Moodle
25.04.2021 by ParanjpeSanmarg
Testing Subdomain Takeover Vulnerability
11.04.2021 by Open Bug Bounty
Better Notifications Mechanism

  Recent Recommendations

@darione90     19 June, 2021
    Twitter darione90:
Many thanks to garlet_marco for finding an XSS vulnerability on our website!
@RyanBoehm12     16 June, 2021
    Twitter RyanBoehm12:
Vighnesh Gupta was professional, considerate, and thorough in helping us resolve a security flaw on our website. He communicated with in a timely manner, and provided all necessary support to fix the issue. I highly recommend him.
@rus_cert     16 June, 2021
    Twitter rus_cert:
Thanks for informing us about the vulnerability and providing helpful details :-)
@Cyber91998806     16 June, 2021
    Twitter Cyber91998806:
He responded to my mails quickly and helped us how to fix the vulnerability in a professional way. I recommended this guy.
@contactsplus     15 June, 2021
    Twitter contactsplus:
Tuhin reported 3 valid vulnerabilities to us of severities High, Medium and Low.

He was very professional and helped us recreate the issues until we were able to verify.
He was awarded a bounty for his efforts.

Thank you Tuhin!

Contacts+ Security Team.