{"id":"14c3755e-740d-4462-9bd6-2b0551796100","engagementId":"1fc37f21-d55a-40c2-a4a5-f99612ffd51c","data":{"brief":{"id":"19c49a77-a749-4c63-b8c2-6d602c9cabda","name":"Santos Vulnerability Disclosure Program","tagline":"Submit your finding to Santos' Vulnerability Disclosure Program","description":"\u003cp\u003eSantos recognizes that the security community is a valuable resource for the security of our technical  systems. To that end, we welcome vulnerability disclosure contributions from security researchers and  strive to facilitate this. \u003c/p\u003e\n\n\u003ch2\u003eRatings/Rewards:\u003c/h2\u003e\n\n\u003cp\u003e\u003cem\u003eFor the initial prioritization/rating of findings, this program will use the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e. However, it is important to note that in some cases a vulnerability priority will be modified due to its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher - along with the opportunity to appeal, and make a case for a higher priority.\u003c/em\u003e\u003c/p\u003e","industryTagId":"aa3a3cad-6509-40b4-9916-5787c039e3f3","targetsOverview":"\u003cp\u003eTesting is only authorized on the targets listed as in scope. Any domain/property of Santos not listed in the targets section is out of scope. This includes any/all subdomains not listed above. If you happen to identify a security vulnerability on a target that is not in scope, but it demonstrably belongs to Santos you can report it to this program. However, be aware that it is ineligible for rewards or points-based compensation.\u003c/p\u003e\n\n\u003ch3\u003eEligible Vulnerabilities\u003c/h3\u003e\n\n\u003cp\u003eWe encourage the coordinated disclosure of the following non-comprehensive list of eligible web  application vulnerabilities: \u003cbr\u003e\n• Cross-site scripting \u003cbr\u003e\n• Cross-site request forgery in a privileged context \u003cbr\u003e\n• Server-side code execution \u003cbr\u003e\n• Authentication or authorization flaws \u003cbr\u003e\n• Injection vulnerabilities \u003cbr\u003e\n• Directory traversal \u003cbr\u003e\n• Information disclosure \u003cbr\u003e\n• Significant security misconfiguration \u003cbr\u003e\nTo receive credit, you must be the first reporter of a vulnerability. When submitting a vulnerability,  please provide concise steps to reproduce that are easily understood.\u003c/p\u003e\n\n\u003cp\u003eAt present no credentials will be provided for authenticated vulnerabilities, this may change in future.\u003c/p\u003e\n\n\u003ch3\u003eProgram Terms and Conditions\u003c/h3\u003e\n\n\u003cul\u003e\n\u003cli\u003eAll email addresses belonging to researchers should be your @bugcrowdninja.com.\u003c/li\u003e\n\u003cli\u003eAny form submissions MUST use your @bugcrowdninja.com email.\nIn any interaction with Santos technical systems, ensure the following terms are complied with: \u003c/li\u003e\n\u003cli\u003eDO NOT perform denial of service type attacks technical systems or related infrastructure \u003c/li\u003e\n\u003cli\u003eDO NOT use social engineering (e.g., phishing, smishing, vishing, email spoofing) techniques • \u003c/li\u003e\n\u003cli\u003eDO NOT use an exploit to view, modify or delete data without authorization \u003c/li\u003e\n\u003cli\u003eDO NOT perform any spam or brute force exploits or any rate limit testing \u003c/li\u003e\n\u003cli\u003eDO NOT perform any physical testing or testing involving physical access \u003c/li\u003e\n\u003cli\u003eDO NOT engage in post-exploitation activities unless explicitly approved by Santos to do so \u003c/li\u003e\n\u003cli\u003eDO NOT knowingly post, transmit, upload, link to, or send any malware\u003c/li\u003e\n\u003cli\u003eDO NOT discuss or otherwise disclose your ongoing work under this policy or any vulnerabilities  with parties outside of the program without explicit consent from Santos \u003c/li\u003e\n\u003cli\u003eDO NOT engage in any activity which can potentially or actually cause harm to Santos, our  customers, our vendors, or our employees. \u003c/li\u003e\n\u003cli\u003eDO NOT engage in activity that violates the law or regulations of any country where (i) data,  assets, or systems reside, (ii) data traffic is routed, or (iii) the researcher is conducting research  activity.\u003cbr\u003e\n\u003c/li\u003e\n\u003cli\u003eDO provide detailed reports with reproducible steps \u003c/li\u003e\n\u003cli\u003eDO ensure scanners have a reasonable request rate limit (e.g., below 6 requests per second) • DO make a good faith effort to avoid privacy violations, destruction of data, and interruptions or  degradation of the in-scope systems \u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ch3\u003eDisclosure\u003c/h3\u003e\n\n\u003cp\u003eIn the interest of fostering coordinated disclosure, Santos will collaborate with finders in good faith who  wish to disclose vulnerabilities. We expect finders to wait until a fix has been made available and  communicated to impacted stakeholders prior to any public notification. \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor:\u003c/h2\u003e\n\n\u003cp\u003eAny activities conducted in a manner consistent with this policy will be considered authorized conduct  and we will not initiate and legal action against you. If legal action is initiated by a third party against you  in connection with activities conducted under this policy, we will take steps to make it known that your  actions were conducted in compliance with this policy in our sole discretion. Santos cannot authorize  any activity on third-party products or guarantee they will not pursue legal action against you. We are  not responsible for the liability from actions performed on third parties.\u003c/p\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":false,"additionalInformation":""},"scope":[{"id":"07471c8b-9a88-4dcb-bfb6-e6db2a1d65dc","name":"In Scope","targets":[{"id":"b574740f-76de-41f0-94b1-9495388bba2f","uri":"https://www.santos.com/","name":"santos.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f681e9d0-10f9-41cf-af8b-1c2cfd02340c","sortOrder":0},"sortOrder":0,"tags":[{"id":"5644ab16-c7ca-4ff7-ac95-383343dab77f","name":"MySQL","targetId":"b574740f-76de-41f0-94b1-9495388bba2f"},{"id":"7ff6bfde-4352-4ff1-b376-565d898c283f","name":"nginx","targetId":"b574740f-76de-41f0-94b1-9495388bba2f"},{"id":"a51a78cb-e0a6-4043-a736-335dec2d238c","name":"jQuery","targetId":"b574740f-76de-41f0-94b1-9495388bba2f"},{"id":"abbd0575-727e-4565-8046-f7fa78eaf368","name":"PHP","targetId":"b574740f-76de-41f0-94b1-9495388bba2f"},{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"b574740f-76de-41f0-94b1-9495388bba2f"}],"recentChangeFlags":null},{"id":"255c3095-15aa-4462-8517-d987c8ff3d13","uri":"","name":"103.252.190.0/24","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"449fa964-faba-4425-8655-57d72cafad8c","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"255c3095-15aa-4462-8517-d987c8ff3d13"},{"id":"6f2f82a5-9ef3-4bc5-9d86-6634e03133e1","name":"Recon","targetId":"255c3095-15aa-4462-8517-d987c8ff3d13"},{"id":"9c63a0f4-0db6-40da-85f0-65d0aa72bfbe","name":"Windows","targetId":"255c3095-15aa-4462-8517-d987c8ff3d13"},{"id":"ad43847d-d5ec-4d65-a1f1-8f20ec7e9238","name":"Penetration Testing","targetId":"255c3095-15aa-4462-8517-d987c8ff3d13"}],"recentChangeFlags":null},{"id":"e62636fd-0b70-439a-81ec-fd184fc6f9df","uri":"","name":"13.73.192.151","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"275d79e3-9c01-4942-920c-bd8889594ae6","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"e62636fd-0b70-439a-81ec-fd184fc6f9df"}],"recentChangeFlags":null},{"id":"fcaba7b5-c93a-46cf-b1fc-607b4d2e45ca","uri":"","name":"13.75.189.223","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"706c323c-0e77-46d8-93ae-b279b851ada0","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"fcaba7b5-c93a-46cf-b1fc-607b4d2e45ca"}],"recentChangeFlags":null},{"id":"2622e54a-dc03-443e-8bd2-73e2a22dd184","uri":"","name":"13.70.109.59","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e2bc052c-f01f-4c5c-bde6-e2742e979332","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"2622e54a-dc03-443e-8bd2-73e2a22dd184"}],"recentChangeFlags":null},{"id":"1e04d0c9-b622-460e-a3ea-0ebf71b32a86","uri":"","name":"52.243.79.77","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d70cf167-a819-4c41-94cd-96b51aafefeb","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"1e04d0c9-b622-460e-a3ea-0ebf71b32a86"}],"recentChangeFlags":null},{"id":"e962dbf9-600b-44f3-be1a-712195cf02c8","uri":"","name":"52.255.37.39","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5b3068bd-f9a6-424b-818e-8ca5728c382a","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"e962dbf9-600b-44f3-be1a-712195cf02c8"}],"recentChangeFlags":null},{"id":"8d3ca4c1-aae9-4fb6-8d08-9908cd80f61d","uri":"","name":"103.55.32.0/24","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"07458852-5c29-4b73-93fb-024c32d9ca43","sortOrder":0},"sortOrder":0,"tags":null,"recentChangeFlags":null},{"id":"e2e3a294-2c25-45f9-99f0-cf7e808f56b8","uri":"","name":"203.0.2.0/23","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"b7b17c3c-28ec-4318-8991-6114a1ef49ea","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"e2e3a294-2c25-45f9-99f0-cf7e808f56b8"}],"recentChangeFlags":null},{"id":"43a32fb1-352a-47bd-bc54-62807c936666","uri":"","name":"192.84.89.0/24","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0cd5b036-b3fe-49e3-8fc5-0643648e55f3","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"43a32fb1-352a-47bd-bc54-62807c936666"}],"recentChangeFlags":null},{"id":"17cc8b93-4ec6-486f-9683-3ec64c99bdec","uri":"","name":"103.196.194.0/24","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e5a2f12f-03cb-4a0a-a013-e48f0e03c774","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"17cc8b93-4ec6-486f-9683-3ec64c99bdec"}],"recentChangeFlags":null},{"id":"1ba5a205-e9c5-49f0-ace3-8d250b508ace","uri":"","name":"121.200.234.0/29","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a774a431-2920-4cfd-8036-4cde59d43f47","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"1ba5a205-e9c5-49f0-ace3-8d250b508ace"}],"recentChangeFlags":null},{"id":"a00cdbb5-4007-4c18-9cb7-c83f14422071","uri":"","name":"45.115.48.0/24","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"99d8aeaa-badf-49e4-9cad-fc5eaa431fa5","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"a00cdbb5-4007-4c18-9cb7-c83f14422071"}],"recentChangeFlags":null},{"id":"33adddb0-a2f7-46c4-9074-ca0abe3bab16","uri":"","name":"45.115.48.5/32","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8362e86f-abf1-4cb8-bbfb-21b2944f6d03","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"33adddb0-a2f7-46c4-9074-ca0abe3bab16"}],"recentChangeFlags":null},{"id":"f6779715-93b3-4d04-984b-5b7820f969e9","uri":"","name":"103.54.238.0/23","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"040b6723-7f0a-4432-bc05-da8408c3a2ce","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"f6779715-93b3-4d04-984b-5b7820f969e9"}],"recentChangeFlags":null},{"id":"c431b9ba-8429-4f36-9726-e000cc49ef71","uri":"","name":"103.6.116.0/24","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"89d72cd2-1ee7-416a-b847-5082fb396408","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"c431b9ba-8429-4f36-9726-e000cc49ef71"}],"recentChangeFlags":null},{"id":"0435f315-efb1-4f67-9198-468e406de806","uri":"","name":"103.199.96.0/24","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"69ce5e2b-9574-425c-923d-7ed0b8fcd08b","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"0435f315-efb1-4f67-9198-468e406de806"}],"recentChangeFlags":null},{"id":"377844ab-670d-439e-b9bb-3862a8fffee2","uri":"","name":"103.199.96.236/30","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d643af38-5204-47b8-a252-cb0e3596d534","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"377844ab-670d-439e-b9bb-3862a8fffee2"}],"recentChangeFlags":null},{"id":"2aa812a2-2192-4186-b46c-1844d6bdbe9a","uri":"","name":"103.199.96.244/30","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d310041a-e102-437f-84f2-5a503e4b967a","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"2aa812a2-2192-4186-b46c-1844d6bdbe9a"}],"recentChangeFlags":null},{"id":"276cd8d0-32b3-4747-b3f8-10940f33214d","uri":"","name":"103.199.96.200/29","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"71de433f-e113-4571-a92a-5aaa1d64a8e5","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"276cd8d0-32b3-4747-b3f8-10940f33214d"}],"recentChangeFlags":null},{"id":"a429032c-e6db-4a65-af34-f39e9ea108a0","uri":"","name":"103.199.96.220/30","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a714ba99-cb66-4040-8519-c8102d454a2a","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"a429032c-e6db-4a65-af34-f39e9ea108a0"}],"recentChangeFlags":null},{"id":"5fcc1607-55c9-4561-8223-88bd7ad158bc","uri":"","name":"103.199.96.128/27","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"44df971b-0ed2-47af-996d-87117f3efa55","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"5fcc1607-55c9-4561-8223-88bd7ad158bc"}],"recentChangeFlags":null},{"id":"af7b5475-ee1f-448f-9024-822acae4201e","uri":"","name":"103.199.96.192/29","category":"other","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"fb4b0abd-6c87-4f15-9bfd-33fa24b1fe70","sortOrder":0},"sortOrder":0,"tags":[{"id":"057eb8bf-b949-4f16-95f2-5bd83851a78d","name":"Network Testing","targetId":"af7b5475-ee1f-448f-9024-822acae4201e"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":null,"descriptionHtml":"\u003cp\u003eThis program scope may include third-party providers and services. We strongly recommend  vulnerability disclosures regarding these services be directed to those respective third parties. We  cannot authorize testing for systems we do not own.  We will move these third party targets into the out of scope section as they are discovered.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null}],"resources":[],"engagement":{"id":"1fc37f21-d55a-40c2-a4a5-f99612ffd51c","code":"santos-vdp","state":"in_progress","endsAt":null,"bountyId":"db274af4-60fa-456a-ba3d-3cdce4a7c957","startsAt":"2022-06-14T19:00:00Z"},"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Oil \u0026 Gas","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/9b77/b29e/3d0650b7/329eb2542850c0be72fdc69e6e682332_STO_FULL_300x300.png","logoBackgroundColor":"#fff","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":false,"participation":"open","rewardAllocation":"no_reward","engagementTypeDetail":{"iconVariant":"vdp","productLabel":"Vulnerability Disclosure","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2022-06-14T19:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/santos-vdp","changelogs":"/engagements/santos-vdp/changelog","submissions":null,"announcements":"/engagements/santos-vdp/announcements","hallOfFame":"/engagements/santos-vdp/hall_of_fames","crowdstream":"/engagements/santos-vdp/crowdstream"},"announcementsCount":0,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/santos-vdp/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=santos-vdp\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/santos-vdp/engagement_subscribers","engagementChangelogsUrl":"/engagements/santos-vdp/changelog","publishedAt":"2025-03-11T13:48:00.530Z","engagementChangelogUrl":"/engagements/santos-vdp/changelog/14c3755e-740d-4462-9bd6-2b0551796100","createUserFeedbacksUrl":"/engagements/santos-vdp/feedbacks","engagementCrowdstreamUrl":"/engagements/santos-vdp/crowdstream","acceptedSubmissionsEnabled":false,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}