{"id":"077de9e3-361c-4594-aa89-752d60d7af45","engagementId":"1d4d711f-972b-44b4-aef4-55eb7c63b450","data":{"brief":{"id":"bea2d679-0616-43dc-b7fc-6765676b7e49","name":"Hack Me!","tagline":"Test out the Bugcrowd platform","description":"\u003ch3\u003eSubmissions to this program will not be rewarded and will not earn points.\u003c/h3\u003e\n\n\u003ch3\u003eThis program is not monitored by Bugcrowd staff. If you believe have a found legitimate vulnerability in the Bugcrowd platform, please submit it to our \u003ca href=\"https://bugcrowd.com/bugcrowd\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ebug bounty program\u003c/a\u003e.\u003c/h3\u003e\n\n\u003cp\u003eMay challenge flag:\u003cbr\u003e\nIt’s a trap!\u003c/p\u003e","industryTagId":"ec1a2bf0-0dfe-4337-bab0-5b2b42dd9508","targetsOverview":"\u003ch2\u003eEmbedded Submission Form\u003c/h2\u003e\n\n\u003cp\u003eThis program features an \u003ca href=\"https://www.bugcrowd.com/hackme-external-form/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eembedded submission form\u003c/a\u003e. This form is an integration with Bugcrowd that customers can host on their own website to take in submissions (via an iframe), and we encourage you to test it.\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"7f964278-f59e-44ca-9459-3ab81274be8d","name":"Primary Targets","targets":[{"id":"0e68901f-3634-4a28-8e9e-ddd1ee5f3979","uri":"https://www.bugcrowd.com","name":"www.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"34df4281-08e8-4125-b0d6-77c1e768a556","sortOrder":0},"sortOrder":0,"tags":[{"id":"487e9af0-2610-4813-a092-ea46f4cb6de1","name":"Wordpress","targetId":"0e68901f-3634-4a28-8e9e-ddd1ee5f3979"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"0e68901f-3634-4a28-8e9e-ddd1ee5f3979"}],"recentChangeFlags":null},{"id":"3e05b6f7-c893-421d-9d63-dcab3c843000","uri":null,"name":"All IT-Managed Third-Party Services and Infrastructure","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"941faa8d-9af1-46de-8b59-fd2bdc9d2493","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"04c05140-1870-43b1-85b4-1e732d176499","uri":"https://api.bugcrowd.com","name":"api.bugcrowd.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5a795f5a-e28a-466e-a86f-88a3f0b434e3","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"30a3c3f4-5f27-4be7-9e4f-5fe8e80828f8","name":"Elasticsearch","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"6a9fe373-cb50-48a4-8f00-f390acde8447","name":"JSON","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"04c05140-1870-43b1-85b4-1e732d176499"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"04c05140-1870-43b1-85b4-1e732d176499"}],"recentChangeFlags":null},{"id":"ee3dea4f-2f70-4df2-863a-a0fe795173fe","uri":"http://www.bugcrowd.com","name":"Test by AN","category":"api","ipAddress":"192.168.0.1","description":"Test for internal use only. This will be deleted. ","engagementBriefTargetGroupTarget":{"id":"af1080b7-6400-4dc1-ab50-467842a76ec2","sortOrder":3},"sortOrder":3,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"ee3dea4f-2f70-4df2-863a-a0fe795173fe"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThe targets in these groups are outside the realm of ownership for our organization. This includes things like partner integrations that we care about but can\u0026#39;t fix and thus reward at the same level as other findings. Including but not limited to:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthentication vulnerabilities through our \u003cstrong\u003eXXXXX\u003c/strong\u003e authentication vendor\u003c/li\u003e\n\u003cli\u003eOur webstore through \u003cstrong\u003eYYYYY\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"45fbfd91-65e8-41c4-a085-e6f1f1b8c512","name":"Out of Scope","targets":[{"id":"4cd63f5a-895d-4aab-97d3-6a5aec5c3e73","uri":"https://docs.bugcrowd.com/","name":"docs.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"23510d77-0317-4cf7-95d4-77770ce8f1bf","sortOrder":0},"sortOrder":0,"tags":[{"id":"40ac7f57-395c-4f6a-82fb-292f80ab0240","name":"HTML","targetId":"4cd63f5a-895d-4aab-97d3-6a5aec5c3e73"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4cd63f5a-895d-4aab-97d3-6a5aec5c3e73"}],"recentChangeFlags":null},{"id":"63e83eb8-a032-4fcf-8ee6-726f8d2c1fd1","uri":null,"name":"researcherdocs.bugcrowd.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"38fd4814-7522-462a-a2e1-8db0dc607a42","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"63e83eb8-a032-4fcf-8ee6-726f8d2c1fd1"}],"recentChangeFlags":null},{"id":"d73c1af1-76bf-4846-bec0-e051702ae540","uri":"https://tracker.bugcrowd.com","name":"Crowdcontrol","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"67d37c6a-a09a-434f-96a9-b12d25dd870a","sortOrder":0},"sortOrder":0,"tags":[{"id":"30a3c3f4-5f27-4be7-9e4f-5fe8e80828f8","name":"Elasticsearch","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"4e9d5c53-3b04-4bca-ba30-e8e33d87019a","name":"Ruby on Rails","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"95cf953e-85ee-42c2-9123-09d81bfe7ba9","name":"PostgreSQL","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"9dded18a-fb38-4faa-b2ac-82845ca03735","name":"ReactJS","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d73c1af1-76bf-4846-bec0-e051702ae540"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":1,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThese targets are out of scope.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"139afcb9-87ec-4a01-84ab-624befe6d518","attachmentPath":"https://bugcrowd.com/engagements/hackme/attachments/139afcb9-87ec-4a01-84ab-624befe6d518","name":"smallest.png","filename":"smallest.png","description":"qa qa","icon":"fileImage","size":16660,"sizeLabel":"16.3 KB","uploadedAt":"10 Jul 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/hackme/attachments/139afcb9-87ec-4a01-84ab-624befe6d518"},{"id":"9ba3a088-97dc-4297-b6e5-773dd3757d60","attachmentPath":"https://bugcrowd.com/engagements/hackme/attachments/9ba3a088-97dc-4297-b6e5-773dd3757d60","name":"Otter_-_Cotswold_Wildlife_Park_(7549754506).jpg","filename":"Otter_-_Cotswold_Wildlife_Park_(7549754506).jpg","description":"A nice, relaxing picture of some otters.","icon":"fileImage","size":270530,"sizeLabel":"264 KB","uploadedAt":"10 Jul 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/hackme/attachments/9ba3a088-97dc-4297-b6e5-773dd3757d60"},{"id":"d334819d-8b09-4f94-95e7-f82a8e16602d","attachmentPath":"https://bugcrowd.com/engagements/hackme/attachments/d334819d-8b09-4f94-95e7-f82a8e16602d","name":"0a4a45c7-9428-473e-9788-8dec0bf265bc_1.27e8c7031ae74705b09273cf7cf9bdec.jpeg","filename":"0a4a45c7-9428-473e-9788-8dec0bf265bc_1.27e8c7031ae74705b09273cf7cf9bdec.jpeg","description":null,"icon":"fileImage","size":87174,"sizeLabel":"85.1 KB","uploadedAt":"10 Jul 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/hackme/attachments/d334819d-8b09-4f94-95e7-f82a8e16602d"},{"id":"077d928c-e0b7-4aed-8f66-238de179813b","attachmentPath":"https://bugcrowd.com/engagements/hackme/attachments/077d928c-e0b7-4aed-8f66-238de179813b","name":"0a4a45c7-9428-473e-9788-8dec0bf265bc_1.27e8c7031ae74705b0927.3cf7cf9bdec.jpeg.zip","filename":"0a4a45c7-9428-473e-9788-8dec0bf265bc_1.27e8c7031ae74705b0927.3cf7cf9bdec.jpeg.zip","description":null,"icon":"fileOther","size":87101,"sizeLabel":"85.1 KB","uploadedAt":"23 Sep 2024","fileType":"ZIP","embedUrl":"https://bugcrowd.com/engagements/hackme/attachments/077d928c-e0b7-4aed-8f66-238de179813b"},{"id":"150432c3-1310-4e6f-b73b-98a53b218984","attachmentPath":"https://bugcrowd.com/engagements/hackme/attachments/150432c3-1310-4e6f-b73b-98a53b218984","name":"demo1","filename":"demo1","description":null,"icon":"fileOther","size":229632,"sizeLabel":"224 KB","uploadedAt":"24 Sep 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/hackme/attachments/150432c3-1310-4e6f-b73b-98a53b218984"},{"id":"1a405d3f-9354-46e6-a9ff-378b0f8b1074","attachmentPath":"https://bugcrowd.com/engagements/hackme/attachments/1a405d3f-9354-46e6-a9ff-378b0f8b1074","name":"CodeResources","filename":"CodeResources","description":null,"icon":"fileOther","size":2200,"sizeLabel":"2.15 KB","uploadedAt":"24 Sep 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/hackme/attachments/1a405d3f-9354-46e6-a9ff-378b0f8b1074"},{"id":"73d21432-5098-4040-8b3c-2a1791dc5331","attachmentPath":"https://bugcrowd.com/engagements/hackme/attachments/73d21432-5098-4040-8b3c-2a1791dc5331","name":"Info.plist","filename":"Info.plist","description":null,"icon":"fileOther","size":1895,"sizeLabel":"1.85 KB","uploadedAt":"24 Sep 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/hackme/attachments/73d21432-5098-4040-8b3c-2a1791dc5331"}],"engagement":{"id":"1d4d711f-972b-44b4-aef4-55eb7c63b450","code":"hackme","state":"in_progress","endsAt":null,"bountyId":"ce734644-3dc5-45c7-bbe2-9a6500aad1cd","startsAt":"2013-09-27T06:00:00Z"},"vrtScopeRules":[{"id":"42ab3781-549d-43e6-8fc3-02f96f28a778","notes":"We don't trouble with taxi drivers!","targets":[],"vrtIds":{"categories":[{"id":"automotive_security_misconfiguration","version":"1.17"}]},"allTargets":true,"targetGroups":[],"exclusionType":"out_of_scope"},{"id":"471148bd-10c2-48b7-8a2b-bca3095a381b","notes":"If we've got a blockchain, it's news to us","targets":[],"vrtIds":{"categories":[{"id":"blockchain_infrastructure_misconfiguration","version":"1.17"}]},"allTargets":true,"targetGroups":[],"exclusionType":"out_of_scope"},{"id":"83ec1727-1291-4357-8785-ae51cb148a15","notes":"This API is not a building, so you really have to explain yourself on this one.","targets":[{"id":"04c05140-1870-43b1-85b4-1e732d176499","name":"api.bugcrowd.com"}],"vrtIds":{"categories":[{"id":"physical_security_issues","version":"1.17"}]},"allTargets":false,"targetGroups":[],"exclusionType":"conditional"},{"id":"9645aaec-14a6-4c19-92a7-8df1b7e4f63c","notes":"We don't consider DoS a valid finding","targets":[],"vrtIds":{"categories":[{"id":"application_level_denial_of_service_dos","version":"1.17"}]},"allTargets":true,"targetGroups":[],"exclusionType":"out_of_scope"},{"id":"0edb0849-3aa9-4dc5-b16d-ca556a62a2f5","notes":"If the vulnerability requires knowledge of a UUID, we don't consider it valid.","targets":[{"id":"04c05140-1870-43b1-85b4-1e732d176499","name":"api.bugcrowd.com"}],"vrtIds":{"categories":[{"id":"broken_access_control","version":"1.17"}]},"allTargets":false,"targetGroups":[],"exclusionType":"conditional"},{"id":"c96e1345-8041-4e3a-8780-0cffeb54a3da","notes":"","targets":[],"vrtIds":{"categories":[{"id":"server_security_misconfiguration.fingerprinting_banner_disclosure","version":"1.17"}]},"allTargets":true,"targetGroups":[],"exclusionType":"conditional"},{"id":"44e2011c-29c6-4d7e-ae2d-fa0af1065a28","notes":"","targets":[],"vrtIds":{"categories":[{"id":"sensitive_data_exposure.exif_geolocation_data_not_stripped_from_uploaded_images.manual_user_enumeration","version":"1.17"}]},"allTargets":true,"targetGroups":[],"exclusionType":"out_of_scope"}],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Construction","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/a55d/4241/0b06b01c/fb20156b643089e88e3b0a68654a392c_smiley-face-1-4-15.png","logoBackgroundColor":"#ffffff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2013-09-27T06:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/hackme","changelogs":"/engagements/hackme/changelog","submissions":null,"announcements":"/engagements/hackme/announcements","hallOfFame":"/engagements/hackme/hall_of_fames","crowdstream":"/engagements/hackme/crowdstream"},"announcementsCount":3,"knownIssuesEnabled":false,"isDemo":true,"serviceLevel":"Platform","submitReportUrl":"/engagements/hackme/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=hackme\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/hackme/engagement_subscribers","engagementChangelogsUrl":"/engagements/hackme/changelog","publishedAt":"2026-06-23T18:10:55.966Z","engagementChangelogUrl":"/engagements/hackme/changelog/077de9e3-361c-4594-aa89-752d60d7af45","createUserFeedbacksUrl":"/engagements/hackme/feedbacks","engagementCrowdstreamUrl":"/engagements/hackme/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[{"id":"42ab3781-549d-43e6-8fc3-02f96f28a778","vrt_ids":{"categories":[{"id":"automotive_security_misconfiguration","lineage":"Automotive Security Misconfiguration","version":"1.17"}]},"targets":[],"target_groups":[],"exclusion_type":"out_of_scope","notes":"We don't trouble with taxi drivers!","all_targets":true},{"id":"471148bd-10c2-48b7-8a2b-bca3095a381b","vrt_ids":{"categories":[{"id":"blockchain_infrastructure_misconfiguration","lineage":"Blockchain Infrastructure Misconfiguration","version":"1.17"}]},"targets":[],"target_groups":[],"exclusion_type":"out_of_scope","notes":"If we've got a blockchain, it's news to us","all_targets":true},{"id":"83ec1727-1291-4357-8785-ae51cb148a15","vrt_ids":{"categories":[{"id":"physical_security_issues","lineage":"Physical Security Issues","version":"1.17"}]},"targets":[{"id":"04c05140-1870-43b1-85b4-1e732d176499","name":"api.bugcrowd.com"}],"target_groups":[],"exclusion_type":"conditional","notes":"This API is not a building, so you really have to explain yourself on this one.","all_targets":false},{"id":"9645aaec-14a6-4c19-92a7-8df1b7e4f63c","vrt_ids":{"categories":[{"id":"application_level_denial_of_service_dos","lineage":"Application-Level Denial-of-Service (DoS)","version":"1.17"}]},"targets":[],"target_groups":[],"exclusion_type":"out_of_scope","notes":"We don't consider DoS a valid finding","all_targets":true},{"id":"0edb0849-3aa9-4dc5-b16d-ca556a62a2f5","vrt_ids":{"categories":[{"id":"broken_access_control","lineage":"Broken Access Control (BAC)","version":"1.17"}]},"targets":[{"id":"04c05140-1870-43b1-85b4-1e732d176499","name":"api.bugcrowd.com"}],"target_groups":[],"exclusion_type":"conditional","notes":"If the vulnerability requires knowledge of a UUID, we don't consider it valid.","all_targets":false},{"id":"c96e1345-8041-4e3a-8780-0cffeb54a3da","vrt_ids":{"categories":[{"id":"server_security_misconfiguration.fingerprinting_banner_disclosure","lineage":"Server Security Misconfiguration \u003e Fingerprinting/Banner Disclosure","version":"1.17"}]},"targets":[],"target_groups":[],"exclusion_type":"conditional","notes":"","all_targets":true},{"id":"44e2011c-29c6-4d7e-ae2d-fa0af1065a28","vrt_ids":{"categories":[{"id":"sensitive_data_exposure.exif_geolocation_data_not_stripped_from_uploaded_images.manual_user_enumeration","lineage":"Sensitive Data Exposure \u003e EXIF Geolocation Data Not Stripped From Uploaded Images \u003e Manual User Enumeration","version":"1.17"}]},"targets":[],"target_groups":[],"exclusion_type":"out_of_scope","notes":"","all_targets":true}]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}