{"id":"3a9c7c4e-e38d-4a5d-9a95-1a568d3349bf","engagementId":"3853a376-4444-49f1-8888-76cdcd742783","data":{"brief":{"id":"f975e3a9-1983-4144-857a-e22f37fad856","name":"NAB's Responsible Disclosure Program","tagline":"Responsible Disclosure Program","description":"\u003cp\u003eThank you for participating in NAB’s Responsible Disclosure Program. The responsible disclosure of security vulnerabilities helps us ensure the security and privacy of NAB and our customers.\u003c/p\u003e\n\n\u003cp\u003eWe continually strive to keep protecting our customers and colleagues through operational resilience while getting things done faster and delivering sustainable outcomes for our customer, colleagues, and the community. Working with Bugcrowd and security researchers fits in with our goals and strategy. After all, a more secure infrastructure means a more secure place for our customers to do their banking.\u003c/p\u003e\n\n\u003ch3\u003eReporting:\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eTo make a disclosure you'll need to first Sign up with Bugcrowd  \u003ca href=\"https://bugcrowd.com/user/sign_up\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://bugcrowd.com/user/sign_up\u003c/a\u003e or login to your existing account.\u003c/li\u003e\n\u003cli\u003ePlease be aware NAB may not correspond with you directly, disclose remediation steps or timeframes.\u003c/li\u003e\n\u003cli\u003e\u003cem\u003e\u003cstrong\u003eNo monetary disbursements for findings will be provided on this program.\u003c/strong\u003e\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eRatings:\u003c/h3\u003e\n\n\u003cp\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher – along with the opportunity to appeal and make a case for a higher priority.\u003c/p\u003e\n\n\u003ch3\u003eGuidelines: \u003c/h3\u003e\n\n\u003cp\u003eTargets on this program are from our Production environment, hence \u003cstrong\u003eall testing needs to be performed in a production safe manner and all the following instructions should be strictly adhered to.\u003c/strong\u003e If you have any questions around something being production safe or not please err on the side of caution and reach out to \u003ca href=\"mailto:support@bugcrowd.com\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003esupport@bugcrowd.com\u003c/a\u003e with any questions. \u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eIf you discover other credentials during recon and testing, \u003cstrong\u003eDo NOT\u003c/strong\u003e use them for additional testing\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDo NOT pursue post-exploitation or pivot from the vulnerable target into other parts of the network\u003c/strong\u003e unless explicitly approved by NAB to do so especially in the following situations: \n\n\u003cul\u003e\n\u003cli\u003eThe exploit will result in a permanent change to the target system and may impact the experience of other users (i.e. Stored Cross-Site Scripting)\u003c/li\u003e\n\u003cli\u003eThe exploit has a high likelihood of impacting the availability of a service\u003c/li\u003e\n\u003cli\u003eThe exploitation may result in sensitive NAB data (i.e. customer or financial information) being leaked\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eScanning Activity Guidelines: to reduce the likelihood of production outages\n\n\u003cul\u003e\n\u003cli\u003eFor any enumeration activities, scanners should be limited to a maximum of 6 requests/second \u003c/li\u003e\n\u003cli\u003eRecursive DNS enumeration should be minimized\u003c/li\u003e\n\u003cli\u003eNAB will not accept generic vulnerability scan results, as these are likely to be duplicated. \u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eAny scanning or brute force attempts on Submission Forms is considered Out-Of-Scope and should not be attempted.\u003c/strong\u003e You may reach out for approval to do manual testing. \u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eFollow the AWS pentesting guidelines where applicable: \u003ca href=\"https://aws.amazon.com/security/penetration-testing/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://aws.amazon.com/security/penetration-testing/\u003c/a\u003e\n\u003c/li\u003e\n\u003c/ul\u003e","industryTagId":null,"targetsOverview":"\u003cp\u003eNAB uses a number of third-party providers and services – including a number hosted on subdomains of nab.com that will be considered OOS for this program. We cannot authorize security testing against systems that do not belong to us but strongly suggest reporting issues identified within these services to the third-party directly. However, if you believe an issue with one of our third-party service providers is the result of NAB's misconfiguration or insecure usage of that service (or you've reported an issue affecting many customers of the service that you believe NAB can temporarily mitigate without stopping usage of the service while a fix is implemented upstream), we'd appreciate your report regarding the issue. \u003c/p\u003e\n\n\u003ch2\u003eCredentials:\u003c/h2\u003e\n\n\u003cp\u003eThe use of personal credentials for testing purposes is strictly prohibited and may trigger or result in investigations by the NAB fraud team and/or law enforcement. Please do not, under any circumstances, use credentials including your own personal account for testing purposes. This is to protect you and your banking accounts, as well as NAB. This program is set up as an unauthenticated program. If you have any questions regarding this matter, please contact support@bugcrowd.com\u003c/p\u003e\n\n\u003ch3\u003eOut-of-Scope\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eIf you discover other credentials during recon and testing, Do NOT use them for additional testing\u003c/li\u003e\n\u003cli\u003eResearchers should NOT pursue post-exploitation unless explicitly approved by NAB to do so\u003c/li\u003e\n\u003cli\u003eCredential Stuffing/Password Spraying attacks\u003c/li\u003e\n\u003cli\u003eStored XSS that might affect any account not owned by you\u003c/li\u003e\n\u003cli\u003eDOS/DDOS\u003c/li\u003e\n\u003cli\u003eSubmission Forms should be considered OOS as they may impact business functions. Please reach out to support@bugcrowd.com to seek authorization for manual testing.\u003c/li\u003e\n\u003c/ul\u003e","safeHarborStatus":{"status":"partial","label":"Partial safe harbor","description":"This engagement provides a limited goodwill statement about not pursuing legal action related to security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"7f3311d2-6eff-4f3d-bb6b-f0bd535c31af","name":"In Scope Targets ","targets":[{"id":"c721a158-7b65-4901-bdd7-c33c4cbad80b","uri":"","name":"*.nab.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"be12879d-1d85-4655-908c-fb891a5e225f","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c721a158-7b65-4901-bdd7-c33c4cbad80b"}],"recentChangeFlags":null},{"id":"b429b733-59d7-4525-9723-c4409f092586","uri":"","name":"*.jbwere.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cc1f04b5-aa84-4b7b-9e75-1d77fd3233de","sortOrder":1},"sortOrder":1,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b429b733-59d7-4525-9723-c4409f092586"}],"recentChangeFlags":null},{"id":"b286160d-d047-4533-9d25-a57f0f517375","uri":"","name":"*.medfin.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"821159d5-5ef6-45f8-bd65-91466ca6728c","sortOrder":2},"sortOrder":2,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b286160d-d047-4533-9d25-a57f0f517375"}],"recentChangeFlags":null},{"id":"e436a159-a02c-426a-b543-3c2bedf37ab4","uri":"","name":"*.nabbroker.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"73f45ef1-1a09-4620-bbab-69e5affc9c63","sortOrder":3},"sortOrder":3,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"e436a159-a02c-426a-b543-3c2bedf37ab4"}],"recentChangeFlags":null},{"id":"657b0042-291a-4c73-b160-438a8819efa0","uri":"","name":"*.nabequitylending.com.au ","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"dd746a14-f7be-4cc0-8286-d25d15a7e2a5","sortOrder":4},"sortOrder":4,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"657b0042-291a-4c73-b160-438a8819efa0"}],"recentChangeFlags":null},{"id":"1df73c38-abcd-4b9b-b739-e690c8d35372","uri":"","name":"*.nabmarginlending.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bedcbf91-cb21-4789-ada6-2e9e1cca5a68","sortOrder":5},"sortOrder":5,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"1df73c38-abcd-4b9b-b739-e690c8d35372"}],"recentChangeFlags":null},{"id":"81e88fa0-d7bf-414e-b0e8-e7d9c8f3adb2","uri":"","name":"*.nabtrade.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"37caafab-f299-470b-b460-f8c1969797d1","sortOrder":6},"sortOrder":6,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"81e88fa0-d7bf-414e-b0e8-e7d9c8f3adb2"}],"recentChangeFlags":null},{"id":"54b19e0d-8c96-4f32-aba7-f93005278480","uri":"","name":"*.ubank.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bfb6364b-4b8e-49c0-ad86-390f0572a800","sortOrder":7},"sortOrder":7,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"54b19e0d-8c96-4f32-aba7-f93005278480"}],"recentChangeFlags":null},{"id":"b08f2ff0-8189-423b-83c4-9e5e0cb0b6eb","uri":"","name":"*.86400.com.au ","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1a66e6a1-11c1-4ff7-92bd-1b0413845139","sortOrder":8},"sortOrder":8,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b08f2ff0-8189-423b-83c4-9e5e0cb0b6eb"}],"recentChangeFlags":null},{"id":"ce5a74af-91bc-479b-a5be-4d8511eb95e2","uri":"","name":"*.claiming.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8adee8d1-35ed-46d4-a586-efdb3c8f8f3e","sortOrder":9},"sortOrder":9,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"ce5a74af-91bc-479b-a5be-4d8511eb95e2"}],"recentChangeFlags":null},{"id":"8797a643-6684-4563-ae01-7b2d6c70976c","uri":"","name":"*.lanternpay.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"06175054-d7cd-4cce-9007-4d90a82d377e","sortOrder":10},"sortOrder":10,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8797a643-6684-4563-ae01-7b2d6c70976c"}],"recentChangeFlags":null},{"id":"4a80f833-3a42-4cd3-adfd-cbc1903f373c","uri":"","name":"*.advantedge.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"70269e69-a9c8-4ef0-827c-c8e63a7df9e5","sortOrder":11},"sortOrder":11,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4a80f833-3a42-4cd3-adfd-cbc1903f373c"}],"recentChangeFlags":null},{"id":"96e9be24-8648-4dc8-98ba-6423bae49684","uri":"","name":"*.hicaps.com.au","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e2fb8c4c-631f-48fe-aeda-f11ccd4ecc7a","sortOrder":12},"sortOrder":12,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"96e9be24-8648-4dc8-98ba-6423bae49684"}],"recentChangeFlags":null},{"id":"c3b82bcb-cb6f-42fe-982a-4afabf261557","uri":"","name":"cards.koganmoney.com.au","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"791c991d-70c9-449e-bab4-6e02ab0ba323","sortOrder":13},"sortOrder":13,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"c3b82bcb-cb6f-42fe-982a-4afabf261557"}],"recentChangeFlags":null},{"id":"d037f6b9-b7b4-46b4-bb29-08602bd7b2cd","uri":"","name":"*.globalfintechlink.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1ee3eba6-d048-443f-a028-b892c2937892","sortOrder":14},"sortOrder":14,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d037f6b9-b7b4-46b4-bb29-08602bd7b2cd"}],"recentChangeFlags":null},{"id":"ba303f0e-3d26-4bba-8f20-231c69e8f01c","uri":"","name":"Any other assets that appear to belong to NAB Group","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5df8d375-c301-484c-b2d8-3cdc7fbc48f8","sortOrder":15},"sortOrder":15,"tags":null,"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"a758f4f1-35c9-4cfd-a046-393b48b6e5b3","attachmentPath":"https://bugcrowd.com/engagements/nationalaustraliabankog/attachments/a758f4f1-35c9-4cfd-a046-393b48b6e5b3","name":"image-2021-04-06T16:39:36.941Z.png","filename":"image-2021-04-06T16:39:36.941Z.png","description":null,"icon":"fileImage","size":13834,"sizeLabel":"13.5 KB","uploadedAt":"2 Sep 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/nationalaustraliabankog/attachments/a758f4f1-35c9-4cfd-a046-393b48b6e5b3"},{"id":"91ab854d-edbb-4dbd-b155-080ef05f1b18","attachmentPath":"https://bugcrowd.com/engagements/nationalaustraliabankog/attachments/91ab854d-edbb-4dbd-b155-080ef05f1b18","name":"image-2021-04-06T16:39:55.656Z.png","filename":"image-2021-04-06T16:39:55.656Z.png","description":null,"icon":"fileImage","size":13834,"sizeLabel":"13.5 KB","uploadedAt":"2 Sep 2024","fileType":"Image","embedUrl":"https://bugcrowd.com/engagements/nationalaustraliabankog/attachments/91ab854d-edbb-4dbd-b155-080ef05f1b18"}],"engagement":{"id":"3853a376-4444-49f1-8888-76cdcd742783","code":"nationalaustraliabankog","state":"in_progress","endsAt":null,"bountyId":"03e6eaed-60f2-4934-9329-497100aec000","startsAt":"2017-11-28T23:59:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":null,"methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/3105/3823/4411eab7/e16ddfe97c179e09036a42c3dc8871e5_0__46_.png","logoBackgroundColor":"#000000","displayDisclosureTerms":true,"coordinatedDisclosure":false,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2017-11-28T23:59:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/nationalaustraliabankog","changelogs":"/engagements/nationalaustraliabankog/changelog","submissions":null,"announcements":"/engagements/nationalaustraliabankog/announcements","hallOfFame":"/engagements/nationalaustraliabankog/hall_of_fames","crowdstream":null},"announcementsCount":4,"knownIssuesEnabled":false,"isDemo":false,"serviceLevel":"P1 24/7","submitReportUrl":"/engagements/nationalaustraliabankog/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=nationalaustraliabankog\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/nationalaustraliabankog/engagement_subscribers","engagementChangelogsUrl":"/engagements/nationalaustraliabankog/changelog","publishedAt":"2025-03-18T07:20:03.887Z","engagementChangelogUrl":"/engagements/nationalaustraliabankog/changelog/3a9c7c4e-e38d-4a5d-9a95-1a568d3349bf","createUserFeedbacksUrl":"/engagements/nationalaustraliabankog/feedbacks","engagementCrowdstreamUrl":null,"acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":false,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}