{"id":"c1fed137-acc0-4508-9396-ee9ea7a6c625","engagementId":"37b7e9e6-d16c-47e1-adf3-3255c70a5be0","data":{"brief":{"id":"daadd0c7-8bfb-4080-bbee-5b4bca539ae0","name":"Majid Al Futtaim Customer Solutions","tagline":"Customer Solutions - A Majid Al Futtaim Program","description":"\u003cp\u003eMajid Al Futtaim invites you to test and help secure our Customer Solutions - focusing on our web and mobile applications and associated API's. We appreciate your efforts and hard work in making the internet (and Customer Solutions) more secure and look forward to working with the researcher community to create a meaningful and successful bug bounty program. Good luck and happy hunting!\u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e\n\n\u003cp\u003e\u003cstrong\u003eValid P4 reports will be upgraded to P3 and paid at the following range:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e$150 - $200\u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"9ed1ce49-a148-438f-92d3-0b8d70b6a8ae","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as In-Scope. \u003cem\u003eAny domain/property of Majid Al Futtaim Customer Solutions not listed in the targets section is out of scope. This includes any/all subdomains not listed above.\u003c/em\u003e \u003c/p\u003e\n\n\u003cp\u003eIf you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Majid Al Futtaim Customer Solutions, you can report it to this engagement. However, be aware that it is ineligible for rewards or points-based compensation.*\u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTarget Information:\u003c/h2\u003e\n\n\u003cp\u003eYou will test Customer Loyalty mobile clients (alongside with their correspondent APIs) on a production environment. This is a loyalty and digital wallet platform that allows customers to earn valuable points across all Majid Al Futtaim brands and malls that can be traded for services and goods. \u003c/p\u003e\n\n\u003ch2\u003eAccess:\u003c/h2\u003e\n\n\u003cp\u003eTo test the mobile applications, feel free to download them from the respective app marketplaces:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAndroid: \u003ca href=\"https://play.google.com/store/apps/details?id=com.maf.share\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://play.google.com/store/apps/details?id=com.maf.share\u003c/a\u003e\n\u003c/li\u003e\n\u003cli\u003eiOS: \u003ca href=\"https://apps.apple.com/ae/app/share-rewards/id1465450657\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://apps.apple.com/ae/app/share-rewards/id1465450657\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eCredentials:\u003c/h3\u003e\n\n\u003cp\u003eTo test the mobile applications and websites, please feel free to provision your own account(s) using your @bugcrowdninja.com e-mail address. More information on the Bugcrowd Ninja e-mail address can be found here: \u003ca href=\"https://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://researcherdocs.bugcrowd.com/docs/your-bugcrowdninja-email-address\u003c/a\u003e\u003c/p\u003e\n\n\u003cp\u003eWe have also provisioned these two test accounts which have some reward points and a test credit card linked. Be mindful that these will be shared amongst all the researchers so don't try to change or reset the password.\u003c/p\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth style=\"text-align: center\"\u003eEmail\u003c/th\u003e\n\u003cth style=\"text-align: center\"\u003ePassword\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd style=\"text-align: center\"\u003emafproperties.synack4@gmail.com\u003c/td\u003e\n\u003ctd style=\"text-align: center\"\u003eSecuriestest1\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd style=\"text-align: center\"\u003emafproperties.synack5@gmail.com\u003c/td\u003e\n\u003ctd style=\"text-align: center\"\u003eSecuriestest1\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003ch2\u003eFocus Areas:\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003ePayment cycle (e.g. payment using rewards without deduction from account)\u003c/li\u003e\n\u003cli\u003eFraudulent addition/earning of reward points\u003c/li\u003e\n\u003cli\u003eAbility to transfer rewards without authorization from other users accounts (e.g. abuse of family functionality)\u003c/li\u003e\n\u003cli\u003eAbility to remotely gain access to other user's PCI details (credit card, CVV, etc)\u003c/li\u003e\n\u003cli\u003eAbility to remotely gain access to other user's personal details (first name, last name ,contact details, passwords, etc)\u003c/li\u003e\n\u003cli\u003eAbility to disclose critical authentication data in clear text (keys, password, etc…)\u003c/li\u003e\n\u003cli\u003eExfiltration of personal data or credit card data\u003c/li\u003e\n\u003cli\u003eRemote unauthorized access to Share database\u003c/li\u003e\n\u003cli\u003eRemote code execution\u003c/li\u003e\n\u003cli\u003eFraudulent use of promo codes\u003c/li\u003e\n\u003cli\u003eDefacement\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eOut-of-Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not modify data residing in an account that does not belong to you\u003c/li\u003e\n\u003cli\u003eDo not access or download data beyond the minimum required to demonstrate a vulnerability. This should not exceed 1-2 records if at all necessary. \u003c/li\u003e\n\u003cli\u003eDo not attempt to execute actions that disrupt the availability of our systems (e.g. any volumetric or denial of service attacks)\u003c/li\u003e\n\u003cli\u003eDo not post, transmit, upload, link to, send, or store any malicious software \u003c/li\u003e\n\u003cli\u003eDo not test in a manner that would result in the sending of unsolicited or unauthorized junk mail, SMS, spam, or other forms of duplicative or unsolicited messages\u003c/li\u003e\n\u003cli\u003eDo not test in a manner that would degrade the performance or operation of any system\u003c/li\u003e\n\u003cli\u003eDo not test third-party applications, websites, or services that integrate with or link to our systems \u003c/li\u003e\n\u003cli\u003eDo not make any changes to the system configurations, files, or data\u003c/li\u003e\n\u003cli\u003eDo not introduce a backdoor in any system \u003c/li\u003e\n\u003cli\u003eDo not conduct non-technical attacks such as social engineering or phishing\u003c/li\u003e\n\u003cli\u003eDo not in any way attack/interact with our end users\u003c/li\u003e\n\u003cli\u003eDo not engage in the trade of stolen/breached user credentials or use leaked credential dumps in the testing (no credential stuffing is allowed)\u003c/li\u003e\n\u003cli\u003eDo not report any DMARC related issue for any in-scope domain\u003c/li\u003e\n\u003cli\u003ePlease give Majid 15 business days to apply any official patches for public zero-day vulnerabilities. Any submissions that are made prior to that window being closed will not be accepted.\u003c/li\u003e\n\u003cli\u003eCredential leaks reports are appreciated, but they are not eligible for reward.\u003c/li\u003e\n\u003cli\u003eAuthentication issues on \u003ca href=\"https://identity.majidalfuttaim.com/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://identity.majidalfuttaim.com/\u003c/a\u003e must be reported to our \u003ca href=\"https://bugcrowd.com/mpass-og\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eMPASS program\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"8c4767fa-44f2-4695-8731-ae3a5c9ecce4","name":"Share Rewards App","targets":[{"id":"f8905336-9fd0-4686-b660-f29dd91043ee","uri":"https://www.sharerewards.com/","name":"https://www.sharerewards.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6cfeb3d8-de0f-4008-99f0-7452c1d5386a","sortOrder":0},"sortOrder":0,"tags":[{"id":"29ad39e7-82e8-4428-8474-fdfb5ceeb8d5","name":"Cloudflare CDN","targetId":"f8905336-9fd0-4686-b660-f29dd91043ee"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"f8905336-9fd0-4686-b660-f29dd91043ee"},{"id":"68da3fae-5355-463e-8442-9a5016b1bda0","name":"ASP.NET","targetId":"f8905336-9fd0-4686-b660-f29dd91043ee"},{"id":"70f8fc74-f147-45d5-8f56-9bff2f555bd7","name":".NET","targetId":"f8905336-9fd0-4686-b660-f29dd91043ee"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"f8905336-9fd0-4686-b660-f29dd91043ee"},{"id":"b6333057-ce1f-4205-bcb6-ce56be83543b","name":"Microsoft IIS","targetId":"f8905336-9fd0-4686-b660-f29dd91043ee"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f8905336-9fd0-4686-b660-f29dd91043ee"}],"recentChangeFlags":null},{"id":"024a3ad6-0f80-425b-bbc3-76b5b0c6d6d6","uri":"https://apps.apple.com/us/app/share-rewards/id1465450657","name":"Share Rewards Programme iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"413a11a9-5172-4ba2-9b43-36dc7247edd8","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"024a3ad6-0f80-425b-bbc3-76b5b0c6d6d6"},{"id":"7692155d-e2db-4c50-abd5-208448a85fde","name":"SwiftUI","targetId":"024a3ad6-0f80-425b-bbc3-76b5b0c6d6d6"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"024a3ad6-0f80-425b-bbc3-76b5b0c6d6d6"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"024a3ad6-0f80-425b-bbc3-76b5b0c6d6d6"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"024a3ad6-0f80-425b-bbc3-76b5b0c6d6d6"}],"recentChangeFlags":null},{"id":"fd7ea08c-b4cd-4a65-926a-5dd2a9c2f454","uri":"https://play.google.com/store/apps/details?id=com.maf.share\u0026hl=en_US\u0026gl=US","name":"Share Rewards Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b41ee0d3-e534-4ba2-b6c6-ba08ff59a091","sortOrder":0},"sortOrder":0,"tags":[{"id":"1892c58d-2dbd-4b0d-96ee-1d2322fd1711","name":"Java","targetId":"fd7ea08c-b4cd-4a65-926a-5dd2a9c2f454"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"fd7ea08c-b4cd-4a65-926a-5dd2a9c2f454"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"fd7ea08c-b4cd-4a65-926a-5dd2a9c2f454"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"fd7ea08c-b4cd-4a65-926a-5dd2a9c2f454"}],"recentChangeFlags":null},{"id":"c6a016ac-0d98-4047-b8cc-c14e6fe1703d","uri":null,"name":"https://www.vtcprodapi.maf.ae/svc/svcHifi.svc/SaveOCRReceipt","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"569a7186-1d12-4e9f-a00b-701c7468320d","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c6a016ac-0d98-4047-b8cc-c14e6fe1703d"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"c6a016ac-0d98-4047-b8cc-c14e6fe1703d"}],"recentChangeFlags":null},{"id":"a62ae90e-b397-4afe-8685-d2d429cb5db3","uri":null,"name":"https://production.maf.auth0.com/api/v2/","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"3c3b5174-ec1a-4ea2-bfbb-0b7ff4c8129c","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"a62ae90e-b397-4afe-8685-d2d429cb5db3"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"a62ae90e-b397-4afe-8685-d2d429cb5db3"}],"recentChangeFlags":null},{"id":"0ba67278-3065-4f58-b760-536a888241ef","uri":null,"name":"https://production.maf.auth0.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bb3b92b8-0987-4fc1-9154-780337e1fcf9","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"0ba67278-3065-4f58-b760-536a888241ef"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"0ba67278-3065-4f58-b760-536a888241ef"}],"recentChangeFlags":null},{"id":"98d791a4-fced-4f43-8f57-79bb04c440fb","uri":"","name":"https://maf-holding-prod.apigee.net","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"98cb3575-bd72-4c70-82c4-2244f4ac6105","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"98d791a4-fced-4f43-8f57-79bb04c440fb"},{"id":"cbf0ee58-c41b-4dee-9d08-cefd01f5d7d6","name":"HTTP","targetId":"98d791a4-fced-4f43-8f57-79bb04c440fb"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"c9d1328e-566d-4ae8-8588-e52b8ec212e4","p1MaxCents":250000,"p1MinCents":210000,"p2MaxCents":150000,"p2MinCents":120000,"p3MaxCents":74900,"p3MinCents":15000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":300000},"descriptionHtml":null,"rewardRangeData":{"1":{"min":2100,"max":2500},"2":{"min":1200,"max":1500},"3":{"min":150,"max":749},"4":{"min":null,"max":null},"5":{"min":null,"max":null},"programMax":3000},"recentChangeFlags":null},{"id":"e810b3f2-c72e-4cbc-b7e5-1f79bca65a44","name":"MPASS Targets","targets":[{"id":"39d0bedb-a691-4f5b-a40b-2eda78662a98","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/9h0hkx6nBNSDuhTSFySzPgcFyXrHOVNI","name":"WIFI","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"40e38264-716e-4067-bd69-7473f0fc3477","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"39d0bedb-a691-4f5b-a40b-2eda78662a98"}],"recentChangeFlags":null},{"id":"d052624c-4948-493d-8f51-946b553b7d20","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/bN1YiObxLzbCkU6z6lRdE8jpGgEM2bqG","name":"SHARE","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b5e09089-5804-4592-9b7c-04cb57ea05e4","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d052624c-4948-493d-8f51-946b553b7d20"}],"recentChangeFlags":null},{"id":"e482c628-c6a5-45d3-ae91-d81b9fb36ead","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/8VdAQsuIqDPQhsNC1sNQtS2Jf7anninl","name":"MOE","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"15fac26c-55c3-4569-be81-3b6e658d51d6","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e482c628-c6a5-45d3-ae91-d81b9fb36ead"}],"recentChangeFlags":null},{"id":"43fe6186-6ce6-4a13-ab21-bd540b274d50","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/zISrnnxfS19jUJTUAtnFaTUkAJ27r8mE","name":"LEGO","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0c934b50-7635-4867-9274-68aef247db49","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"43fe6186-6ce6-4a13-ab21-bd540b274d50"}],"recentChangeFlags":null},{"id":"4db9115f-10e5-4b4f-bd3a-40e6c31a45ea","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/0dfwUn870OFm3aebVTKv0xz1viKKyXlL","name":"SKI-DUBAI","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5089010c-afb0-474e-9519-57b66f37b50c","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4db9115f-10e5-4b4f-bd3a-40e6c31a45ea"}],"recentChangeFlags":null},{"id":"515f1f2c-69c2-4d65-8cf8-96a078e2b196","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/C1o8u0aPez0Qs5W5TGa1Cbpxq8Ieb63G","name":"CRATE-BARREL","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"58090c37-2d01-47cd-b427-d14b526a96dd","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"515f1f2c-69c2-4d65-8cf8-96a078e2b196"}],"recentChangeFlags":null},{"id":"59d2da53-e6a1-49ce-bfef-fc06b52681ed","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/I3ev7JpJpG4tmIKuXfQ5s29e1uUgtdaL","name":"THAT","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d1ef36cd-3d27-4e27-81a8-952df477b1c6","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"59d2da53-e6a1-49ce-bfef-fc06b52681ed"}],"recentChangeFlags":null},{"id":"66d9ae12-531d-41be-a209-e0d6f7af8c22","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/gbYSXvAJqSRL0gb76oaWWBojroIDBJrb","name":"THAT-MOBILE","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c01a24da-c6de-4462-a9bf-ae858fb96fae","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"66d9ae12-531d-41be-a209-e0d6f7af8c22"}],"recentChangeFlags":null},{"id":"c170c311-11aa-45fe-9870-35dbf50baf5f","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/v0uVcrcyayqiTSbRUJPAWz2YJNN1tHTy","name":"VOX","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4480bd58-198e-4ed6-ae75-369708a024e4","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c170c311-11aa-45fe-9870-35dbf50baf5f"}],"recentChangeFlags":null},{"id":"cae62aa6-4cfc-4404-8bae-edc0c789cf0d","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/9AHmz8YYRY6OVVTNHtLKjrFgwovO1eDE","name":"VOX-MOBILE","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"463ec1d4-19ce-4b98-a42c-f1b699eda649","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cae62aa6-4cfc-4404-8bae-edc0c789cf0d"}],"recentChangeFlags":null},{"id":"fa1edcf2-47a9-47a9-be9e-99106cc6b49f","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/abGQxSUDBML2iWEP9P1KWjxnUi7RwfT1","name":"CBU","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"211f1b7b-63ed-43af-b35e-f5cf68f1c41d","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"fa1edcf2-47a9-47a9-be9e-99106cc6b49f"}],"recentChangeFlags":null},{"id":"642f039e-dccd-4ad4-b96b-ae9a57ccba65","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/kfwPMuCVbxNPvPpfDKiyvgVvHWmThXc8","name":"ALLSAINTS","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"095223e1-913d-471d-a993-9f5c0f645a5b","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"642f039e-dccd-4ad4-b96b-ae9a57ccba65"}],"recentChangeFlags":null},{"id":"f01b4131-aa65-4a2b-988a-4d31ab4949c5","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/VhYxO10cBfgbvQ1KzcO0XYIsz9kLahZ6","name":"CB2","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"584f4525-f4d6-48d4-96e0-cdc7140d0432","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f01b4131-aa65-4a2b-988a-4d31ab4949c5"}],"recentChangeFlags":null},{"id":"74de6042-bcfd-4d84-99a3-de2d9524d136","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/xD3ktDwA9dnX1xNLig2S3oM8xvxXTnty","name":"MAGIC-PLANET","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b006bea8-2b18-4606-8098-542d2280f3a9","sortOrder":13},"sortOrder":13,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"74de6042-bcfd-4d84-99a3-de2d9524d136"}],"recentChangeFlags":null},{"id":"691be647-7050-445f-b9f7-91448f974673","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/gsUkX5A6BA7wJLQxEiIjdC8PDrNJ42Mo","name":"MR-USTA","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aca9e121-bef6-494c-bb0c-701920b708ef","sortOrder":14},"sortOrder":14,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"691be647-7050-445f-b9f7-91448f974673"}],"recentChangeFlags":null},{"id":"dec759b6-6624-492a-bca6-883cefdd08e0","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/hqrMBSRmjuH85ACKnBvUEvOoBJllGPWn","name":"MAFID-FAB","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a2d69bc7-1a74-4893-98b5-44a494c83e4b","sortOrder":15},"sortOrder":15,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"dec759b6-6624-492a-bca6-883cefdd08e0"}],"recentChangeFlags":null},{"id":"57fe48da-8199-45e9-b40f-a77ddeb1f3a3","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/p1Ji7cKQ7RG5KU3Jjuke5ZMG6vfWe0IV","name":"MAFID-DREAMSCAPE","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1f99a414-44eb-4ffc-adad-2049d6a10eb7","sortOrder":16},"sortOrder":16,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"57fe48da-8199-45e9-b40f-a77ddeb1f3a3"}],"recentChangeFlags":null},{"id":"b0b41dbe-bf18-4b22-8ed2-2b54bc52d2d4","uri":"https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/mPbXCx7lA4dQNyEhhyCGMV6XKjuccbk8","name":"MAFID-MOE-MOBILE","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c1430d2e-f0c7-45cb-951c-2a607429e930","sortOrder":17},"sortOrder":17,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b0b41dbe-bf18-4b22-8ed2-2b54bc52d2d4"}],"recentChangeFlags":null},{"id":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed","uri":"https://www.premogiftcards.com/","name":"www.premogiftcards.com/","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"289940b2-e0c2-47ad-a3fe-36ff9d6e2e99","sortOrder":18},"sortOrder":18,"tags":[{"id":"005d6fd9-5c1a-45f7-a2b6-af0e2fdfd820","name":"Laravel","targetId":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed"},{"id":"32a00682-97f0-4d01-852d-f06359bdc440","name":"Bootstrap","targetId":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed"},{"id":"a5bf7fc5-03c4-42f4-b10d-5ceb23d1c064","name":"Lodash","targetId":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed"},{"id":"ce8ff3cd-4d54-4404-8321-6351781551a3","name":"Vue.js","targetId":"cf7c22d6-1b38-4788-bb8c-f2b9e3dc28ed"}],"recentChangeFlags":null},{"id":"3588ab21-4f8d-4a63-90a8-d83440bd1eae","uri":"https://identity.majidalfuttaim.com","name":"MPASS MAFid, Identity.majidalfutaaim.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"a689d2e1-386d-4d8d-b8e6-f4b8dd3e1d8f","sortOrder":19},"sortOrder":19,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"db84b5d4-9c76-47c0-9e58-8b3e92294f33","p1MaxCents":250000,"p1MinCents":210000,"p2MaxCents":125000,"p2MinCents":100000,"p3MaxCents":60000,"p3MinCents":15000,"p4MaxCents":null,"p4MinCents":null,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003ch2\u003eTarget information\u003c/h2\u003e\n\n\u003cp\u003eMajid Al Futtaim wants you to test new SSO system. You can sign up for an account and test the target\u0026#39;s authentication. There is nothing behind the login form except a confirmation that you\u0026#39;re logged in.\u003c/p\u003e\n\n\u003ch2\u003eCredentials:\u003c/h2\u003e\n\n\u003cp\u003eResearchers must use the Bugcrowd email alias [username]@bugcrowdninja.com to self-sign up to the applications. You only need to sign up once and can use the account in all of the applications. For more info regarding @bugcrowdninja email addresses read \u003ca href=\"https://docs.bugcrowd.com/researchers/participating-in-program/your-bugcrowdninja-email-address/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\n\n\u003ch2\u003eOut of scope\u003c/h2\u003e\n\n\u003cp\u003eCredential leaks reports are appreciated, but they are not eligible for reward.\u003c/p\u003e","rewardRangeData":{"1":{"min":2100,"max":2500},"2":{"min":1000,"max":1250},"3":{"min":150,"max":600},"4":{"min":null,"max":null},"5":{"min":null,"max":null}},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"37b7e9e6-d16c-47e1-adf3-3255c70a5be0","code":"majidalfuttaim-loyalty","state":"in_progress","endsAt":null,"bountyId":"70271377-67f6-4995-a06b-5efb65b79ac9","startsAt":"2019-07-16T18:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Retail","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/0367/6b1b/96cbe1f0/fc9941ff36adc60246d7bfec733db604_ShareApp_Logo.jpg","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2019-07-16T18:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/majidalfuttaim-loyalty","changelogs":"/engagements/majidalfuttaim-loyalty/changelog","submissions":null,"announcements":"/engagements/majidalfuttaim-loyalty/announcements","hallOfFame":"/engagements/majidalfuttaim-loyalty/hall_of_fames","crowdstream":null},"announcementsCount":2,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/majidalfuttaim-loyalty/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=majidalfuttaim-loyalty\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/majidalfuttaim-loyalty/engagement_subscribers","engagementChangelogsUrl":"/engagements/majidalfuttaim-loyalty/changelog","publishedAt":"2026-07-29T11:35:16.211Z","engagementChangelogUrl":"/engagements/majidalfuttaim-loyalty/changelog/c1fed137-acc0-4508-9396-ee9ea7a6c625","createUserFeedbacksUrl":"/engagements/majidalfuttaim-loyalty/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}