SMS-ACTIVATE
Browser
Sariyaaji partisiipagol e nder porogaraam Bug Bounty
Bismilla e nder porogaraam Bug Bounty! Partisiipagol maa ina wallita ɓeydude keerol geɗe men e servisiiji men. Tiiɗno, anndu sariyaaji garooji ɗii ngam tabitinde golle baawɗe e laaɓtuɗe.
Rejistaas e Verifikasiyoŋ
- Rejistaas: ngam partisiipee e nder porogaraam o, aɗa foti reedotoo e dow lowre ndee sms-activate.ai Hokku kont Telegram maa e sahaa rejistaas ngam yamre e jaabawol;
- Verifikasiyoŋ: Aɗa foti rewnude e nder proses verifikasiyoŋ ngam heɓde peccal. Jaajol laaɓtungol na sendee e maa e Telegram so tawii jaabawol maa jaɓaama.
Hokkude jaabawoli
- Ƴeewtagol Sariyaaji: Hade a hokkata jaabawol maa, tiiɗno anndu sariyaaji partisiipagol e noone caɗeele ɗe mbaawi yeewteede;
- Formil Jaabawol: huutoro formil o e dow page o sms-activate.ai/bugbountyForm ngam hokkude jaabawol maa. Jaabawol maa foti waɗde sifaa laaɓtungal caɗeel, toɓɓe ngam winndude ɗum kadi, seede (nate, videyooji) e firooji ngam feewnude ɗum;
- Fiiluuji ɓeydiiɗi: ɓeydu fiiluuji goɗɗi ngam tabitinde caɗeel so tawii ina haani;
Proses Ƴeewtagol Jaabawoli
Jaabawol maa na ƴeewtee no feewi e kuulemen keerol. Proses oo waawi ƴettude balɗe capanɗe tati. E nder ndeen sahaa, jaabawol oo waawi heɓde darnde wano: "pending", "sorted", "jaɓaaka moderator", "habaru ɓeydiiɗo haani", e ko nanndi heen.
Noone Caɗeele
E nder
aɗa heɓat limto noone caɗeele ɗe njokkataa e heɓde njeñtudi. E nder
kriteeruuji ƴeewtagol darnde caɗeel ina ciforii.
Verifikasiyoŋ e Sutura
Keɗe cuuɗi fof ɗe a hokki ngam verifikasiyoŋ kuutoretee tan ngam anndude ma, te nde ndokkaa e terɗe tataɓe so a jaɓaaki. Minen min mbayla ko waawi ngam tabitinde sutura e keerol keɗe maa.
Peccal
Caggal verifikasiyoŋ moƴƴo e tabitinde caɗeel, njeñtudi na hokkee maa. Adadu njeñtudi o anndiretee e dow darnde caɗeel e laaɓal jaabawol hokkaaɗo.
Normeji laamuyankooje
Min njiylotoo wonde jamaaɓe ɓee no waɗa ko haani e laamu. Alaa jaabawol ngam huutoraade caɗeele yiytaaɗe ngam addude bonannde, heɓde jaabawol tawa alaa tiidnal e dow keeri walla sisteme, maa yaajinde humpito e dow caɗeel ndee haa nde foti.
Battane
Min njokkii darnde maa e nder ɓeydugol keerol geɗe e kuutoragol amen. Partisipasiyoŋ maa no wallita sosde nokku dijitaal mo alaa kadi fof.
Min njaɓɓinii ma feere e nder yiylugol caɗeele! Darnde maa woodataa limto, ko ɗum waɗi min moƴƴinii sabu ballal maa e dow keerol sisteme amen.
Appendix A
Dime caɗeele ɗe ngonaa ko heɓat njeñtudi (caɗeele toowngo ɗe ngalaa battane mawɗe so huutoraama, ina jeyaa heen):
- IDOR (habaruuji e dow ndee sifa caɗeel keɓetee tan so toowngo mum mawnii; toowngo ngoo annditirtee ko e hooreejo men so caɗeel ndee tabitinaama);
- Kala sifa caɗeele XSS, so wonaa Stored XSS (habaruuji e dow caɗeel Stored XSS keɓetee ko e dow faandaare resoor web o);
- Jokkugol e dow klik;
- URI waylotooɗo mo alaa kisal;
- Limtingo direkte waawaa; (kuutoragol geɗe, backup) e Hollirde keɓe ɗe poti haɗeede (fawaade e keɓe ɗe holliraama; limtooji e ndee caɗeele jaɓetee so tawii keɓe mawɗe heɓaama);
- Mod debug dartinii, mo hollataa keɓe mawɗe;
- Caɗeele CSRF, keɓaaɗe e nder gollal ngal wonaa ko mawɗo;
- Hollitgol panel admin (so tawii ɗaamoojo bug o yiyii dashboard admin, kono waawaa heɓde konte walla keɓde kabaruuji goɗɗi mawɗi);
- Jokkondiral Kuutoroowo tawi alaa hollitgol kabaruuji mawɗi;
- Njuɓɓudi Jaajol Ngol Ndeeƴaani, so tawii alaa daliilu wonde haɗre ndee waɗii;
- Jaabotoo wonde a rokkaay geɗe;
- Spam；
- Ingeniiriya sosiyal, moƴƴiniraaɗo gollooɓe, kuutorooɓe mbaadi, walla kiliyankooɓe;
- Ɗaɗol fizik ngol firti heɓde jikkuuji walla senteeruuji keɓe
- Joom sistim;
- Riport waɗaama e kuutorgol kuule otomatiki e skan;
- Juumre e software tataɓere;
- Alaa header-ji jaajol ɗi njokkataa e juumre feccere;
- Dartingol SSL / TLS;
- Juumre-je tiiɗnoo tan kuutorooɓe paltoruuji e platform-ji majjuɗi walla ɗi alaa lisans;
- Politikaji password e heɓtagol konte, wano no fotde sahaa reset link walla doole password;
- Rekord DNS moƴƴaaki, ko ɗo hollirta e sistem mo jom sistem oo jogii.
Limoore
Appendix B
Nooneeji caɗeele e dow daraja mawngu:
Caɗeel
Lesɗungu
Hakkundeejo
Mawnungu
Yahrugol Laawol
10
40
70
Limtingo direkte waawaa;
10
40
URI Dillere Mo Alaa Kisal
5
10
Clickjacking
5
Brute Force
5
SQL Injection (baas deede woowaande, baas deede nafaniinde)
10
40
70
XML External Entity Injection
50
70
Jokkondiral Fiilal Nokkuure
50
Gollal Kodde Woɗɗungu
10
50
100
Yaltine Gite Sifaa
50
90
Jokkondiral Konte
50
90
Insecure Direct Object References
10
Stored XSS
20-30
Reflected XSS
10-20
Dille Server-Side
40-60
Cross-Site Request Forgery
10-20
Race Condition
10
90
Server-Side Template Injection
20
80
Yahrugol Laawol
Lesɗungu
10
Hakkundeejo
40
Mawnungu
70
Limtingo direkte waawaa;
Lesɗungu
10
Hakkundeejo
40
Mawnungu
URI Dillere Mo Alaa Kisal
Lesɗungu
5
Hakkundeejo
10
Mawnungu
Clickjacking
Lesɗungu
5
Hakkundeejo
Mawnungu
Brute Force
Lesɗungu
5
Hakkundeejo
Mawnungu
SQL Injection (baas deede woowaande, baas deede nafaniinde)
Lesɗungu
10
Hakkundeejo
40
Mawnungu
70
XML External Entity Injection
Lesɗungu
Hakkundeejo
50
Mawnungu
70
Jokkondiral Fiilal Nokkuure
Lesɗungu
Hakkundeejo
50
Mawnungu
Gollal Kodde Woɗɗungu
Lesɗungu
10
Hakkundeejo
50
Mawnungu
100
Yaltine Gite Sifaa
Lesɗungu
Hakkundeejo
50
Mawnungu
90
Jokkondiral Konte
Lesɗungu
Hakkundeejo
50
Mawnungu
90
Insecure Direct Object References
Lesɗungu
10
Hakkundeejo
Mawnungu
Stored XSS
Lesɗungu
20-30
Hakkundeejo
Mawnungu
Reflected XSS
Lesɗungu
10-20
Hakkundeejo
Mawnungu
Dille Server-Side
Lesɗungu
Hakkundeejo
40-60
Mawnungu
Cross-Site Request Forgery
Lesɗungu
10-20
Hakkundeejo
Mawnungu
Race Condition
Lesɗungu
10
Hakkundeejo
Mawnungu
90
Server-Side Template Injection
Lesɗungu
20
Hakkundeejo
Mawnungu
80
Poinuuji keɓeteeɗi no feewi e dow daraja caɗeel ngel ko nii:
- Daraja lesɗungu - gila 0 haa 30 poinuuji;
- Daraja hakkundeejo - gila 31 haa 60 poinuuji;
- Daraja mawnungu - gila 61 haa 100 poinuuji.
- sms-activate.ai
- hstock.org
- ipkings.io
Njeñtudi
Ɓeydugol njeñtudi ina fawii e mawngu caɗeel ngel, no newi huutoraade mum, e batte mum e dow keɓe kuutorooɓe. Daraja mawngu nguu ko heewi wonde e golle e pirogramuuɓe te waawi ƴettude sahaa juutɗo.
Caɗeel
Njeñtudi
Gollal Kodde Woɗɗungu (RCE)
$1500 - $5000
Jokkondiral fiilal nokkuure e goɗɗum (LFR, RFI, XXE)
$500 - $3000
Injections
$500 - $3000
Cross-Site Scripting (XSS), so tawii wonaa Self-XSS
$100 - $500
SSRF, so tawii wonaa blind
$300 - $1000
Blind SSRF
$100 - $500
Jippagol ƴellitagol / IDORs / Firlitgol kabaruuji e keɓe cuuɗiiɗe walla kabaruuji kuutorooɓe laaɓtuɗi
$70 - $1150
Goɗɗe caɗeele ɗe tiiɗnaama
Ina fawii e no feewirtaa
Golle SMS-Activate fof ɗe njokkondiri e keɓe kuutorooɓe ina naatiraa. Golle amen ena mbaawi heɓeede e Google Play
e App Store
e innde SMS-Activate
Aplikasiyoŋaaji
Caɗeel
Njeñtudi
Gollal Kodde Woɗɗungu (RCE)
$1500 - $5000
Jokkondiral fiilal nokkuure e goɗɗum (LFR, RFI, XXE)
$500 - $3000
Injections
$500 - $3000
SSRF, so tawii wonaa blind
$300 - $1000
Blind SSRF
$100 - $500
Jippagol ƴellitagol / IDORs / Firlitgol kabaruuji e keɓe cuuɗiiɗe walla kabaruuji kuutorooɓe laaɓtuɗi
$70 - $1150
Cross-Site Request Forgery (CSRF, ƴeewndo crossdomain Flash, CORS)
$35 — $300
Goɗɗe caɗeele ɗe tiiɗnaama
Ina fawii e no feewirtaa