{"id":"5dc33ba8-650a-409f-81b7-06081b37fd7d","engagementId":"1875e271-e624-421b-a2ea-0ddad924385c","data":{"brief":{"id":"76d2d2d6-d808-4810-bb1a-2c8056d7b7c7","name":"Entain Public Managed Bug Bounty Engagement 2024","tagline":"One of the world’s largest sports betting and gaming groups ","description":"\u003cp\u003eThe Entain Group appreciates the important work of the security community and its researchers who identify and report potential vulnerabilities. No technology is perfect and we believe that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. We are excited for you to participate as a security researcher to help us identify vulnerabilities in our web and mobile apps. Good luck, and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":null,"targetsOverview":"\u003cp\u003e\u003cem\u003eTesting is only authorized on the targets listed as In-Scope. Any domain/property of Entain not listed in the targets section is out of scope. This includes any/all subdomains not listed above.  If you happen to identify a security vulnerability on a target that is not in-scope, but that demonstrably belongs to Entain, it may be reported to this program, and is appreciated - but will ultimately be marked as ‘not applicable’ and will not be eligible for monetary compensation.\u003c/em\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eYou are testing on production. Behavior that compromises the stability and integrity of the site is out of scope. For example, do not target other user's data (use one of your other sets of credentials), delete/remove/edit parts of the site, engage any sort of DoS attack, and/or compromise any target's ability to function for other users. If you believe that you have found a vulnerability of this nature, please stop further testing and report it.\u003c/p\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo gain access to the application, please sign up for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see \u003ca href=\"https://researcherdocs.bugcrowd.com/v2.0/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e. \u003c/p\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eGDPR, any way to access other customers data\u003c/li\u003e\n\u003cli\u003eGame function and logic, any way to cheat or steal winnings\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch2\u003eThird party services\u003c/h2\u003e\n\n\u003cp\u003eEntain uses third-party providers and services – including a number hosted on subdomains across our brands that will be considered Out of Scope for this program.\u003cbr\u003e\nWe cannot authorise security testing against systems that do not belong to us, however we would encourage you to report any issues identified within these services to the third-party directly. However, if you believe an issue with one of our third-party service providers is the result of Entain's misconfiguration or insecure usage of that service, we would appreciate it greatly if you could share your finding.\u003c/p\u003e\n\n\u003cp\u003eIf you are unsure if a particular asset is in scope or sits with a third party within this program, please reach out to \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/home\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e and we will help you out.\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cp\u003eAnything not declared as a target or in scope above should be considered out of scope for the purposes of this bug bounty. However to help avoid grey areas, below are examples of what is considered out of scope.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eThe use of Automated scanners is prohibited (we have these tools and its reports too)\u003c/li\u003e\n\u003cli\u003eArbitrary file upload without references to an uploaded file\u003c/li\u003e\n\u003cli\u003eBest practices violations (password complexity, expiration, re-use, etc.)\u003c/li\u003e\n\u003cli\u003eClickjacking without a suitably demonstrated impact\u003c/li\u003e\n\u003cli\u003eCORS missconfigurations on non sensitive endpoints\u003c/li\u003e\n\u003cli\u003eCross-domain referrer leakage\u003c/li\u003e\n\u003cli\u003eCross-site Request Forgery (CSRF) without a proven impact\u003c/li\u003e\n\u003cli\u003eCSV Injection\u003c/li\u003e\n\u003cli\u003eDisclosing API keys without proven impact (including Google Maps API)\u003c/li\u003e\n\u003cli\u003eE-mail bombing due to a lack of rate limiting\u003c/li\u003e\n\u003cli\u003eE-mail spoofing issues - SPF, DMARC or DKIM\u003c/li\u003e\n\u003cli\u003eHomograph attacks\u003c/li\u003e\n\u003cli\u003eHost Header Injection\u003c/li\u003e\n\u003cli\u003eHTTP Request smuggling without any proven impact\u003c/li\u003e\n\u003cli\u003eImage Metadata\u003c/li\u003e\n\u003cli\u003eMissing autocomplete attribute on login fields.\u003c/li\u003e\n\u003cli\u003eMissing cookie flags on non-session based cookies\u003c/li\u003e\n\u003cli\u003eMissing HTTP security headers (as referenced by https://owasp.org/www-project-secure-headers/)\u003c/li\u003e\n\u003cli\u003eMixed content type issues\u003c/li\u003e\n\u003cli\u003eOpen redirects for product domains are accepted, but are not qualified for reward unless there is additional security impact, e.g. ability to steal authentication token.\u003c/li\u003e\n\u003cli\u003eOpen ports without a proven impact\u003c/li\u003e\n\u003cli\u003eRate limit issues without a proven impact\u003c/li\u003e\n\u003cli\u003eReverse tabnabbing\u003c/li\u003e\n\u003cli\u003eSelf-XSS\u003c/li\u003e\n\u003cli\u003eSession Invalidation Issues (logout, change password, adding 2fa)\u003c/li\u003e\n\u003cli\u003eSSL configuration issues (ie. TLS versions, weak ciphers, forward secrecy enabled...)\u003c/li\u003e\n\u003cli\u003eUsername / email enumeration\u003c/li\u003e\n\u003cli\u003eVulnerabilities primarily caused by browser/plugin defects and not representative of defects in the security of Entain systems\u003c/li\u003e\n\u003cli\u003eVulnerability reports related to the reported version numbers of web servers, services, or frameworks\u003c/li\u003e\n\u003cli\u003eVulnerability reports relating to sites, software or network devices not owned by the Entain Group\u003c/li\u003e\n\u003cli\u003eXMLRPC enabled or WP-Scripts Presence\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cstrong\u003eCurrent employees, former employees, and any members of their immediate families are not eligible to participate in this Bug Bounty Program.\u003c/strong\u003e\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003ePublic Disclosure\u003c/h2\u003e\n\n\u003cp\u003eBefore disclosing an issue publicly we require that you first request permission from us. Entain will process requests for public disclosure on a per report basis. Requests to publicly disclose an issue that has not yet been fixed for customers will be rejected. Any researcher found publicly disclosing reported vulnerabilities without Entain's group written consent will have any allocated bounty withdrawn and disqualified from the program.\u003c/p\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ecreate a ticket with Bugcrowd Support\u003c/a\u003e for clarification before proceeding.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"326c4429-6609-4f6b-a8ce-2702de76fbe8","name":"In scope targets","targets":[{"id":"74fbf0ae-5851-4469-94d3-0eb1fd8cf33d","uri":"https://www.partypoker.com","name":"Partypoker Website (and all its subdomains)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0dc22481-b402-484e-990e-a0a719b78eac","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"74fbf0ae-5851-4469-94d3-0eb1fd8cf33d"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"74fbf0ae-5851-4469-94d3-0eb1fd8cf33d"},{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"74fbf0ae-5851-4469-94d3-0eb1fd8cf33d"}],"recentChangeFlags":null},{"id":"f27ae082-2472-4e3c-9c8a-5c1b2c1f6864","uri":"https://www.ladbrokes.com","name":"Ladbrokes Digital  (and all its subdomains)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a9a9c9ab-32cd-4190-abf6-e31a9db8c4f9","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"f27ae082-2472-4e3c-9c8a-5c1b2c1f6864"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f27ae082-2472-4e3c-9c8a-5c1b2c1f6864"}],"recentChangeFlags":null},{"id":"b53f04a9-5270-4d55-b9cd-de36d7c44e53","uri":"https://www.coral.co.uk","name":"Coral Sports  (and all its subdomains)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8ed8f7a0-d270-4546-bdc8-6b214b8caead","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"b53f04a9-5270-4d55-b9cd-de36d7c44e53"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b53f04a9-5270-4d55-b9cd-de36d7c44e53"}],"recentChangeFlags":null},{"id":"eccd090a-4deb-4aaf-a164-4e342418c7f8","uri":"https://www.galabingo.com","name":"Gala Bingo (and all its subdomains)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"db24a5ad-22e1-4a61-9567-17151dcde77a","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"eccd090a-4deb-4aaf-a164-4e342418c7f8"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"eccd090a-4deb-4aaf-a164-4e342418c7f8"}],"recentChangeFlags":null},{"id":"0f327cc7-2503-46ea-95e6-d44fecc4d023","uri":"https://www.partycasino.com","name":"Partycasino Website (and all its subdomains)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2978eb22-18f1-4c5e-9b18-c9eee4d7dd17","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0f327cc7-2503-46ea-95e6-d44fecc4d023"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0f327cc7-2503-46ea-95e6-d44fecc4d023"},{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"0f327cc7-2503-46ea-95e6-d44fecc4d023"}],"recentChangeFlags":null},{"id":"6d004a38-9272-4dd7-ad50-a7538d447580","uri":"https://www.bwin.com","name":"Bwin Website (and all its subdomains)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f5f88e2c-1774-4135-8a5a-85d24d170d2c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"6d004a38-9272-4dd7-ad50-a7538d447580"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"6d004a38-9272-4dd7-ad50-a7538d447580"},{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"6d004a38-9272-4dd7-ad50-a7538d447580"}],"recentChangeFlags":null},{"id":"f53b066c-643f-4d40-8deb-13248218f120","uri":"http://media.itsfogo.com/media/upload/mobile/android/apk/partycasino_com.apk","name":"Partycasino APK","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"81f08b92-4054-43eb-b102-09dac2e99fb7","sortOrder":0},"sortOrder":0,"tags":[{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"f53b066c-643f-4d40-8deb-13248218f120"}],"recentChangeFlags":null},{"id":"6ed1c775-6756-433d-b7eb-8b3029940481","uri":"https://apps.apple.com/gb/app/bwin-poker-and-casino-games/id410242773","name":"Bwin Poker-Casino iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"70e0761c-de13-4cf7-843b-9b4b627bcc8d","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"6ed1c775-6756-433d-b7eb-8b3029940481"}],"recentChangeFlags":null},{"id":"15920848-d4ef-4df2-8bed-cfbb903faee3","uri":"https://apps.apple.com/gb/app/bwin-sports-betting/id393760245","name":"Bwin Sports iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0da147bc-cdbc-47fa-ae16-4984d10feee3","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"15920848-d4ef-4df2-8bed-cfbb903faee3"}],"recentChangeFlags":null},{"id":"52c12886-d1ca-4290-b76c-ddb83b0d172f","uri":"https://apps.apple.com/gb/app/partycasino-play-casino-games/id818432894","name":"Partycasino iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"619ec7bc-8acc-4cc3-b242-cd02fd681b5c","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"52c12886-d1ca-4290-b76c-ddb83b0d172f"}],"recentChangeFlags":null},{"id":"ffc240c0-f093-47a7-89b3-5ae2f37c850c","uri":"https://apps.apple.com/gb/app/partypoker-texas-holdem-poker/id687740281","name":"Partypoker iOS","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"886bdca8-9012-4939-be3f-ef9f792c2150","sortOrder":0},"sortOrder":0,"tags":[{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"ffc240c0-f093-47a7-89b3-5ae2f37c850c"}],"recentChangeFlags":null},{"id":"64ecfdc6-7145-41f8-b903-f33a7eacc397","uri":"https://www.galacasino.com","name":"Gala Casino Website (and all its subdomains)","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bfdd2e39-6cca-4573-b941-ce3e87754f06","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"64ecfdc6-7145-41f8-b903-f33a7eacc397"},{"id":"c2f2c6ac-2793-4871-a93d-2cf8c9ae10cc","name":"Games","targetId":"64ecfdc6-7145-41f8-b903-f33a7eacc397"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"cf2bea6d-a0f7-4d15-8e9c-713f74e4535f","p1MaxCents":500000,"p1MinCents":100000,"p2MaxCents":200000,"p2MinCents":50000,"p3MaxCents":60000,"p3MinCents":20000,"p4MaxCents":20000,"p4MinCents":10000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":null,"rewardRangeData":{"1":{"min":1000,"max":5000},"2":{"min":500,"max":2000},"3":{"min":200,"max":600},"4":{"min":100,"max":200},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"1875e271-e624-421b-a2ea-0ddad924385c","code":"entain-public-mbb-og","state":"in_progress","endsAt":null,"bountyId":"91fdf193-4ecb-4d43-97eb-43dcc9c73294","startsAt":"2024-11-12T08:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/1181/bd25/698b292e/e7fad5f9d17062a848f04ae577d712f0_e7867d9bc708190c2d7ce2baba6e4262_1607589296370.jpeg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2024-11-12T08:00:00.039Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/entain-public-mbb-og","changelogs":"/engagements/entain-public-mbb-og/changelog","submissions":null,"announcements":"/engagements/entain-public-mbb-og/announcements","hallOfFame":"/engagements/entain-public-mbb-og/hall_of_fames","crowdstream":"/engagements/entain-public-mbb-og/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/entain-public-mbb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=entain-public-mbb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/entain-public-mbb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/entain-public-mbb-og/changelog","publishedAt":"2025-04-22T12:00:31.213Z","engagementChangelogUrl":"/engagements/entain-public-mbb-og/changelog/5dc33ba8-650a-409f-81b7-06081b37fd7d","createUserFeedbacksUrl":"/engagements/entain-public-mbb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/entain-public-mbb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}