{"id":"cfe0ee72-f35a-498c-aefc-997075164376","engagementId":"2f960334-69c2-4280-b30c-6977369516eb","data":{"brief":{"id":"686893da-f140-45ff-92b9-62533f6887a6","name":"Tripadvisor ","tagline":"The world’s largest travel site. Know better. Book better. Go better.","description":"\u003cp\u003eTripadvisor, the world's largest travel guidance platform, helps hundreds of millions of people each month become better travelers, from planning to booking to taking a trip. Travelers across the globe use the Tripadvisor site and app to discover where to stay, what to do and where to eat based on guidance from those who have been there before.\u003c/p\u003e\n\n\u003cp\u003eThank you in advance for your contributions to our program! We look forward to working with you to keep Tripadvisor secure.  Good luck and happy hunting! \u003c/p\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eGeneral Program Rules\u003c/h2\u003e\n\n\u003cp\u003eViolating program rules may result in your bounty being omitted.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eInteracting with legitimate live properties is strictly forbidden.\u003c/strong\u003e Even minor actions such as marking a review as helpful are forbidden.\u003c/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eInteracting with legitimate customers is strictly forbidden.\u003c/strong\u003e Always use your own accounts to create all entities needed for your testing (e.g. hotel, hotel owner and traveler). Even minor actions such as inviting the customer to a trip are forbidden.\u003c/li\u003e\n\u003cli\u003eDo not post inappropriate content and images, even on test properties. Content you submit must be suitable for work and schools environment.\u003c/li\u003e\n\u003cli\u003eIdentify your activity as belonging to Bugcrowd, whether you are performing manual testing or using automated tools:\n\n\u003cul\u003e\n\u003cli\u003eInclude the string \"bugcrowd\" in your User-Agent\u003c/li\u003e\n\u003cli\u003eAlways use accounts containing the word \"bugcrowd\" when adding any content (i.e. John Bugcrowd or alice.bugcrowd@gmail.com)\u003c/li\u003e\n\u003cli\u003eAdd \"bugcrowd\" to one of the fields of any form post not requiring account information\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eIn the unlikely event of legitimate customer sending you a message, request or similar, please explain that you are using a test account and your property is not real.\u003c/li\u003e\n\u003cli\u003eIf creating your own property, make sure to follow the rules below. \u003cstrong\u003eCreating properties in popular tourist areas is strictly forbidden.\u003c/strong\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eField\u003c/th\u003e\n\u003cth\u003eValue\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eFirst name\u003c/td\u003e\n\u003ctd\u003eMust contain Bugcrowd\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eLast name\u003c/td\u003e\n\u003ctd\u003eTest\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eProperty Name\u003c/td\u003e\n\u003ctd\u003eMust contain Bugcrowd\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eCity\u003c/td\u003e\n\u003ctd\u003eAtafu (location id 446951)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eBank Country\u003c/td\u003e\n\u003ctd\u003eUnited Kingdom\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eAccount Number\u003c/td\u003e\n\u003ctd\u003e12345678\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eSort Code\u003c/td\u003e\n\u003ctd\u003e70 99 99\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eUse test properties whenever possible\u003c/strong\u003e. Only if the functionality you are trying to test does not exist in test properties, you may create your own property for testing. See the list of test properties below.\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Hotel_Review-g1136459-d25067110-Reviews-Birch_and_Elms_Guesthouse-Wubin_Western_Australia.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Hotel 1\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Hotel_Review-g38222-d26369769-Reviews-Little_Maple_Inn-New_Providence_Iowa.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Hotel 2\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"http://www.tripadvisor.com//VacationRentalReview-g312741-d4019276-1bedroomNorthEndapartment1-%0ABuenosAiresCapitalFederal_District.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Vacation Rental 1\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/VacationRentalReview-g41952-d3984977-One_bedroom_north_end_ApartmentWorcester_Massachusetts.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Vacation Rental 2\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Restaurant_Review-g1575471-d25067126-Reviews-Tidewater_Shoals-Baja_California_Sur_Baja_California.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Restaurant 1\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Restaurant_Review-g312641-d25067125-Reviews-Cherry_and_Walnut-Northern_Cape.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Restaurant 2\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Attraction_Review-g303488-d25067121-Reviews-Cool_Culture_Tours-State_of_Rio_de_Janeiro.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Tour\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Attraction_Review-g21373069-d25067119-Reviews-Look_At_That_Tours-Draa_Tafilalet.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Tour 2\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Attraction_Review-g12521087-d25067113-Reviews-Mahogany_Valley_Tavern-Miecourt_Canton_of_Jura.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Attraction\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://www.tripadvisor.com/Attraction_Review-g3225523-d25067118-Reviews-Maplesmith_Gifts-Vastra_Gotaland_County_West_Coast.html\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eTest Attraction 2\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eYou must abide guidelines specific to each scope tier which are listed in sections below.\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eTripadvisor Triage and Reporting\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eThis program adheres to the \u003ca href=\"https://bugcrowd.com/vulnerability-rating-taxonomy\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Vulnerability Rating Taxonomy\u003c/a\u003e for the initial prioritization/rating of findings.\u003c/li\u003e\n\u003cli\u003eThis bounty follows Bugcrowd’s \u003ca href=\"https://bugcrowd.com/resources/standard-disclosure-terms\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003estandard disclosure terms\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eKudos points awarded will vary based on the priority of your submission. \u003ca href=\"https://www.bugcrowd.com/blog/how-we-measure-researcher-performance/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eHow We Measure Crowd Performance\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eReports should contain demonstrated practical impact and attack scenario. \u003c/li\u003e\n\u003cli\u003eReports should include full HTTP requests and responses.\u003c/li\u003e\n\u003cli\u003eFinal decisions on vulnerability priority and bounty amount are made by Tripadvisor security team for each report individually. \u003c/li\u003e\n\u003c/ul\u003e","industryTagId":"46b8dcc8-bbd9-4a60-80ab-ab088c2bc3e4","targetsOverview":"\u003ch2\u003eOut of Scope\u003c/h2\u003e\n\n\u003cul\u003e\n\u003cli\u003eInformation-stealer logs / exposed credentials that has no access to the internal resources. Please note that, info-stealer logs may be accepted if the detected credential can be used for \u003cstrong\u003eaccessing internal resources.\u003c/strong\u003e\n\u003c/li\u003e\n\u003cli\u003eHTTP Header security related findings such as missing headers.\u003c/li\u003e\n\u003cli\u003eIDOR in property owner features is temporarily out of scope\u003c/li\u003e\n\u003cli\u003eContent fraud such as inflating or deflating a property's rating, insertion of bogus properties within the listings\nor raising the helpful vote count of a review.\u003c/li\u003e\n\u003cli\u003eMass content submission, account creation or spamming.\u003c/li\u003e\n\u003cli\u003eDenial of service attacks or any testing that causes disruption of service.\u003c/li\u003e\n\u003cli\u003eSocial engineering attacks, including open redirects. Open redirects bugs may be accepted if there is more impact than social engineering attacks.\u003c/li\u003e\n\u003cli\u003eAttacks requiring physical access to Tripadvisor locations or property.\u003c/li\u003e\n\u003cli\u003eAttacks against our artificial intelligence systems.\u003c/li\u003e\n\u003cli\u003eExploits that require physical access to the device or that require warranty voiding actions (e.g., rooting victim device).\u003c/li\u003e\n\u003cli\u003eExploits against the site from webviews within mobile applications NOT published by Tripadvisor.\u003c/li\u003e\n\u003cli\u003eDomains that do not send email are not eligible for rewards relating to email misconfiguration (e.g. DMARC misconfiguration).\u003c/li\u003e\n\u003cli\u003eMobile application vulnerabilities that require having a malicious application installed will have drastically reduced priority class because of prerequisite.\u003c/li\u003e\n\u003cli\u003eTripadvisor Plus functionality\u003c/li\u003e\n\u003cli\u003eReputation Pro features in Tripadvisor main app\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBrands owned by Tripadvisor Media Group but operate independently:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eCruiseCritic (main website https://www.cruisecritic.com/)\u003c/li\u003e\n\u003cli\u003eTheFork / LaFourchette (main website https://www.thefork.com/)\u003c/li\u003e\n\u003cli\u003eJetSetter (main website https://www.jetsetter.com/)\u003c/li\u003e\n\u003cli\u003eSeatGuru (main website https://www.seatguru.com/)\u003c/li\u003e\n\u003cli\u003eViator (main website https://www.viator.com/)\u003c/li\u003e\n\u003cli\u003eHelloReco (main website https://www.helloreco.com/)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003cp\u003eDomains owned by companies for which TAMG only has a minority investment in. Including, but not limited to, traxo.com. \u003cem\u003eIf in doubt as to whether a target applies here, please create a submission asking if the particular app/target is in or out of scope.\u003c/em\u003e\u003c/p\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003chr\u003e\n\n\u003ch2\u003eSafe Harbor\u003c/h2\u003e\n\n\u003cp\u003e\u003cstrong\u003eWhen conducting vulnerability research according to this policy, we consider this research to be:\u003c/strong\u003e\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eAuthorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;\u003c/li\u003e\n\u003cli\u003eExempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;\u003c/li\u003e\n\u003cli\u003eExempt from restrictions in our Terms \u0026amp; Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and\u003c/li\u003e\n\u003cli\u003eLawful, helpful to the overall security of the Internet, and conducted in good faith.\u003c/li\u003e\n\u003cli\u003eYou are expected, as always, to comply with all applicable laws.\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003e\u003cem\u003eIf at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire through the \u003ca href=\"https://bugcrowd-support.freshdesk.com/support/tickets/new\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003eBugcrowd Support Portal\u003c/a\u003e before going any further.\u003c/em\u003e\u003c/p\u003e","safeHarborStatus":{"status":"full","label":"Safe harbor","description":"This engagement is fully committed to providing safe harbor for good-faith security research."},"collaborationEnabled":true,"additionalInformation":""},"scope":[{"id":"2640628c-0680-4fa3-96e9-6a49aa836901","name":"Tier 1 Targets","targets":[{"id":"7cdf2a08-311e-4e0c-917a-4b14b3fa03ef","uri":"https://api.production.cde.tamg.cloud","name":"api.production.cde.tamg.cloud","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1c59ef65-16a5-4060-ad77-512aa33def65","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"7cdf2a08-311e-4e0c-917a-4b14b3fa03ef"}],"recentChangeFlags":null},{"id":"62fb8dde-819c-4340-abc3-4126039f8274","uri":"https://partnerapi.tapayments.com","name":"partnerapi.tapayments.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"6d22a410-8a06-4fc7-af15-ac778c720499","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"62fb8dde-819c-4340-abc3-4126039f8274"}],"recentChangeFlags":null},{"id":"49cfc597-6741-4872-9306-a2a36c312ea7","uri":"https://partnerapi1.tapayments.com","name":"partnerapi1.tapayments.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e03179a6-aee8-4dae-abe4-bc7b5e6880b3","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"49cfc597-6741-4872-9306-a2a36c312ea7"}],"recentChangeFlags":null},{"id":"da6c7851-b5c3-4cb3-b323-a0450c17e31b","uri":"https://partnerapi2.tapayments.com","name":"partnerapi2.tapayments.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9fc5a120-343d-431b-920b-c893f0200a93","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"da6c7851-b5c3-4cb3-b323-a0450c17e31b"}],"recentChangeFlags":null},{"id":"c1e1624b-c010-45a9-a8f8-33b0feb0dcc1","uri":"https://walletproxy.tapayments.com","name":"walletproxy.tapayments.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2655f0af-334d-493c-8eb3-1de0b2f506f6","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c1e1624b-c010-45a9-a8f8-33b0feb0dcc1"}],"recentChangeFlags":null},{"id":"20caba02-4c34-4845-bed6-16d1e77d54da","uri":"https://walletproxy1.tapayments.com","name":"walletproxy1.tapayments.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d2956d3f-a1ac-44bc-8466-a1446c1e73dc","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"20caba02-4c34-4845-bed6-16d1e77d54da"}],"recentChangeFlags":null},{"id":"38359242-d4ba-4592-9ef5-189e7d633a31","uri":"https://walletproxy2.tapayments.com","name":"walletproxy2.tapayments.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5c5ed691-0ba0-484d-b27d-3723673e2601","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"38359242-d4ba-4592-9ef5-189e7d633a31"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":0,"description":null,"rewardRange":{"id":"6e9072d4-550f-4c17-9663-edfc936e332e","p1MaxCents":500000,"p1MinCents":500000,"p2MaxCents":125000,"p2MinCents":125000,"p3MaxCents":90000,"p3MinCents":90000,"p4MaxCents":25000,"p4MinCents":25000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eOur main web application www.tripadvisor.com communicates with tier1 APIs for payment functionalities. There is no public documentation for the CDE API, but all endpoints can be discovered by interacting with payment functionalities on www.tripadvisor.com.\u003c/p\u003e","rewardRangeData":{"1":{"min":5000,"max":5000},"2":{"min":1250,"max":1250},"3":{"min":900,"max":900},"4":{"min":250,"max":250},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"a564b9bd-6a6b-42c6-9530-39ae1792a1a5","name":"Tier 2 Targets","targets":[{"id":"87e67f72-e43d-46d5-b2ef-43f99e6026d0","uri":"https://www.tripadvisor.com","name":"www.tripadvisor.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"5aa74dac-23a6-4446-8ec3-836faadf82ae","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"87e67f72-e43d-46d5-b2ef-43f99e6026d0"}],"recentChangeFlags":null},{"id":"9c9b0242-b0b7-4ece-8987-2a558c57c8de","uri":"","name":"Localized versions of www.tripadvisor.com available from the site's header or footer","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d60509c2-22c2-40fe-bd0e-d77ebc480580","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9c9b0242-b0b7-4ece-8987-2a558c57c8de"}],"recentChangeFlags":null},{"id":"c421b029-49fb-4fb7-9ae4-cf46d2c39beb","uri":"https://api.tripadvisor.com","name":"api.tripadvisor.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"341ff7fd-e611-4543-ae0e-0e0bcc7bfd15","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c421b029-49fb-4fb7-9ae4-cf46d2c39beb"}],"recentChangeFlags":null},{"id":"c76991b1-7aac-451f-a935-0e7a54d76e74","uri":"https://service.platform.tripadvisor.com","name":"service.platform.tripadvisor.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ba5e90b8-ccd7-4b3b-95fd-82ec450a362b","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"c76991b1-7aac-451f-a935-0e7a54d76e74"}],"recentChangeFlags":null},{"id":"ec166774-2e26-430e-b33e-b6bf7d9d6261","uri":"https://gwapi.tripadvisor.com","name":"gwapi.tripadvisor.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8ed3ce71-63aa-4d6c-99a5-bfd538cc90d7","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"ec166774-2e26-430e-b33e-b6bf7d9d6261"}],"recentChangeFlags":null},{"id":"8bc4fe48-dfe0-4175-91a0-52779d28c733","uri":"https://gwapi1.tripadvisor.com","name":"gwapi1.tripadvisor.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"057ad33d-5ef0-4f49-8848-346243bbcea9","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"8bc4fe48-dfe0-4175-91a0-52779d28c733"}],"recentChangeFlags":null},{"id":"772cd36a-9af0-49c9-a0da-b4ba27428aea","uri":"https://gwapi2.tripadvisor.com","name":"gwapi2.tripadvisor.com","category":"api","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"9025583f-aca9-48c1-a566-d5dd8cb906de","sortOrder":0},"sortOrder":0,"tags":[{"id":"1f2fc0ed-8b79-47a2-a6dc-564a2d9d0828","name":"API Testing","targetId":"772cd36a-9af0-49c9-a0da-b4ba27428aea"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":1,"description":null,"rewardRange":{"id":"f71588fb-5bcd-4235-a4ea-69d50bcd6486","p1MaxCents":300000,"p1MinCents":300000,"p2MaxCents":90000,"p2MinCents":90000,"p3MaxCents":40000,"p3MinCents":40000,"p4MaxCents":15000,"p4MinCents":15000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eYou may use the following API key: adf6d1b8-0aca-4b0c-a492-50530aadd7aa\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eYou can see overview of our APIs at \u003ca href=\"https://developer-tripadvisor.com/home/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttps://developer-tripadvisor.com/home/\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePartner API documentation can be found at \u003ca href=\"http://api.tripadvisor.com/api/partner/2.0/doc?key=adf6d1b8-0aca-4b0c-a492-50530aadd7aa\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehttp://api.tripadvisor.com/api/partner/2.0/doc?key=adf6d1b8-0aca-4b0c-a492-50530aadd7aa\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e","rewardRangeData":{"1":{"min":3000,"max":3000},"2":{"min":900,"max":900},"3":{"min":400,"max":400},"4":{"min":150,"max":150},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"4cbe6951-cb8a-4d87-821e-2eb145e0cca6","name":"Tier 3 Targets","targets":[{"id":"283afaa0-8c76-487c-b68e-0f0df8d8d630","uri":null,"name":"Any publicly accessible Tripadvisor web asset or host (domains, ip space, etc) - except for assets listed as Out-of-Scope below. ","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bcc8f7ef-ab1e-45e5-bcbb-6bc2ce4b90e9","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"283afaa0-8c76-487c-b68e-0f0df8d8d630"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":2,"description":null,"rewardRange":{"id":"92b8bfb3-2ef6-407a-956d-027c4f7ebc30","p1MaxCents":150000,"p1MinCents":150000,"p2MaxCents":45000,"p2MinCents":45000,"p3MaxCents":15000,"p3MinCents":15000,"p4MaxCents":5000,"p4MinCents":5000,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eNote that tamg.cloud subdomains that end with -sbx are sandbox (testing) projects. Normally, only test data flows through them therefore disclosing \u0026quot;sensitive\u0026quot; data on those is mostly not an issue in reality. \u003c/p\u003e","rewardRangeData":{"1":{"min":1500,"max":1500},"2":{"min":450,"max":450},"3":{"min":150,"max":150},"4":{"min":50,"max":50},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"fee92f5e-cfcd-4206-bfbe-0958e6a60d6e","name":"Tripadvisor Mobile","targets":[{"id":"bf5132a1-aade-4f02-8c83-784504a396fa","uri":"https://play.google.com/store/apps/details?id=com.tripadvisor.tripadvisor\u0026hl=en","name":"Tripadvisor Android App","category":"android","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"575bfba0-497e-4448-bf63-edfd52e51ea7","sortOrder":0},"sortOrder":0,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"bf5132a1-aade-4f02-8c83-784504a396fa"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"bf5132a1-aade-4f02-8c83-784504a396fa"},{"id":"ee1461dd-e5fd-4e9d-8c95-0344ba08bdc2","name":"Android","targetId":"bf5132a1-aade-4f02-8c83-784504a396fa"}],"recentChangeFlags":null},{"id":"ccad1227-5ac6-4105-b3eb-286c1f49ff63","uri":"https://apps.apple.com/us/app/tripadvisor-plan-book-trips/id284876795","name":"Tripadvisor iOS App","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"567cd00f-2da4-4cb3-b024-4131128dd8bd","sortOrder":0},"sortOrder":0,"tags":[{"id":"4aeb1677-ac84-4afd-827e-054b363ca984","name":"GraphQL","targetId":"ccad1227-5ac6-4105-b3eb-286c1f49ff63"},{"id":"c4d77d88-21a3-4a8d-81b7-555e301c483e","name":"Kotlin","targetId":"ccad1227-5ac6-4105-b3eb-286c1f49ff63"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"ccad1227-5ac6-4105-b3eb-286c1f49ff63"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":3,"description":null,"rewardRange":{"id":"6b2ce619-e658-49a2-a646-95e123622796","p1MaxCents":350000,"p1MinCents":350000,"p2MaxCents":75000,"p2MinCents":75000,"p3MaxCents":35000,"p3MinCents":35000,"p4MaxCents":7500,"p4MinCents":7500,"p5MaxCents":null,"p5MinCents":null,"engagementMaxCents":null},"descriptionHtml":"\u003cp\u003eThe apps can be downloaded via Google Play for Android or the App Store for iOS.\u003c/p\u003e","rewardRangeData":{"1":{"min":3500,"max":3500},"2":{"min":750,"max":750},"3":{"min":350,"max":350},"4":{"min":75,"max":75},"5":{"min":null,"max":null}},"recentChangeFlags":null},{"id":"d41944d2-c0ed-4869-bc1d-290fdb056abb","name":"Vacation Rentals","targets":[{"id":"85362de1-2419-4aad-a1a0-8fb03e630c03","uri":"https://rentals.tripadvisor.com","name":"rentals.tripadvisor.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"df1e376f-dd9f-4076-8187-74b176b58dc5","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"85362de1-2419-4aad-a1a0-8fb03e630c03"}],"recentChangeFlags":null},{"id":"34e4569b-88a8-4880-89a1-a8168ae55699","uri":"https://*.vacationhomerentals.com","name":"*.vacationhomerentals.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"80eb3807-fc69-4bdb-a91d-c741968efd71","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"34e4569b-88a8-4880-89a1-a8168ae55699"}],"recentChangeFlags":null},{"id":"9f6f0d1d-75b2-49f5-a3db-ae907804dc4c","uri":"https://*.holidaylettings.com","name":"*.holidaylettings.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"0d51235c-4d97-49ef-a9ef-7be863167dae","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9f6f0d1d-75b2-49f5-a3db-ae907804dc4c"}],"recentChangeFlags":null},{"id":"d4569da1-ae29-4a60-ba6d-f409f0163d5a","uri":"https://*.flipkey.com","name":"*.flipkey.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"4626260b-b6ac-4e9e-884a-990b09b64ca6","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"d4569da1-ae29-4a60-ba6d-f409f0163d5a"}],"recentChangeFlags":null},{"id":"05b7c185-a84a-4edd-922c-86db8e4a13cf","uri":"https://*.niumba.com","name":"*.niumba.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"8642368b-8044-43f8-8451-ad0b90bd0395","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"05b7c185-a84a-4edd-922c-86db8e4a13cf"}],"recentChangeFlags":null},{"id":"3d96db76-0ee6-43bf-8fcc-1cb4360266ee","uri":"https://*.housetrip.com","name":"*.housetrip.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e548a884-acff-42e0-b8a4-c0e13e6714cc","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"3d96db76-0ee6-43bf-8fcc-1cb4360266ee"}],"recentChangeFlags":null},{"id":"78cfa372-4236-48c6-a130-177cf6184b6b","uri":"https://itunes.apple.com/us/app/vacation-rentals-owner-app-by-tripadvisor/id1045663228?mt=8","name":"Tripadvisor Owner APP (https://itunes.apple.com/us/app/vacation-rentals-owner-app-by-tripadvisor/id1045663228?mt=8)","category":"ios","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"c158b053-3c8f-4ade-9040-76da587350b3","sortOrder":0},"sortOrder":0,"tags":[{"id":"63c4a71d-215f-49ca-8ea8-240dfbf82d61","name":"Objective-C","targetId":"78cfa372-4236-48c6-a130-177cf6184b6b"},{"id":"a47bcaa8-a080-4539-b4ca-e699e72d2023","name":"Swift","targetId":"78cfa372-4236-48c6-a130-177cf6184b6b"},{"id":"a6a12b60-e857-44a3-9cc9-3aa9a21aa203","name":"Mobile Application Testing","targetId":"78cfa372-4236-48c6-a130-177cf6184b6b"},{"id":"e251f4f0-1204-4c8a-9e12-dba8fdaadf48","name":"iOS","targetId":"78cfa372-4236-48c6-a130-177cf6184b6b"}],"recentChangeFlags":null},{"id":"a9611a50-1e0b-4a72-acf1-0b5fcbf2d996","uri":"http://marlo.ext.tripadvisor.com","name":"marlo.ext.tripadvisor.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d2959b22-7b6e-472e-95be-13dbea1e2074","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a9611a50-1e0b-4a72-acf1-0b5fcbf2d996"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":4,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch4\u003eNote that submissions for vacation rentals section are rewarded with points only, they are not eligible for bounties.\u003c/h4\u003e\n\n\u003cp\u003e\u003cstrong\u003eIMPORTANT: Vacation Rentals has been sundowned. However, there might still be some leftovers. We encourage you to look for any vulnerability related to our systems!\u003c/strong\u003e\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"e457a130-6562-4d7c-bfc7-774c02b0524f","name":"Bokun","targets":[{"id":"a2aa3b0c-dfcf-4d0a-a005-d1facb998ee0","uri":"https://*.bokundemo.com","name":"*.bokundemo.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"ebd2cfa4-10a7-433c-b891-57106cf1a4fd","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a2aa3b0c-dfcf-4d0a-a005-d1facb998ee0"}],"recentChangeFlags":null},{"id":"994001f9-cdf0-43ed-a68d-d0122965f879","uri":"https://*.bokuntest.com","name":"*.bokuntest.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"580aecde-ca01-4703-87c8-afa36914ff74","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"994001f9-cdf0-43ed-a68d-d0122965f879"}],"recentChangeFlags":null}],"inScope":true,"sortOrder":5,"description":null,"rewardRange":null,"descriptionHtml":"\u003ch2\u003eAccess and Guidelines\u003c/h2\u003e\n\n\u003ch4\u003eNote that submissions for Bokun section are rewarded with points only, they are not eligible for bounties.\u003c/h4\u003e\n\n\u003ch3\u003eAccounts\u003c/h3\u003e\n\n\u003cp\u003eYou must be using “vulnscan” prefix in your vendor/supplier name when registering for an account for both types of scans (manual and/or automatic). Do not create an excessive number of accounts. Two accounts should be enough for testing the marketplace whereas a single account should be enough for any other intent or purpose.\u003c/p\u003e\n\n\u003ch3\u003eTypes of scans\u003c/h3\u003e\n\n\u003cp\u003ePlease focus on manual testing rather than using automated tools as the latter are already employed. Nevertheless, if you choose to ignore this advice and use automated tools, you must ensure the request rate to our systems does not exceed a 1 request per second. On top of that, we would also kindly ask you to use a HTTP Agent header which identifies such requests.\u003c/p\u003e\n\n\u003cp\u003eEmail us in advance (vulnerabilities@bokun.io) if you will be using an automated tool. Our working hours are mostly those in the UTC time zone. \u003c/p\u003e\n\n\u003cp\u003eIt is \u003cstrong\u003estrictly forbidden\u003c/strong\u003e to run automated or manual vulnerability testing on production systems (listed in \u0026quot;Out of scope\u0026quot; section below).\u003c/p\u003e\n\n\u003ch3\u003eInformation on systems in scope\u003c/h3\u003e\n\n\u003cp\u003eAlias to this environment is “test”. Both external domains are just synonyms to the same service. There should be no difference between using either of them.\u003c/p\u003e\n\n\u003cp\u003eOur test environment, hosted at extranet.bokuntest.com has virtually identical setup as prod component-wise. We use this environment to experiment with near-prod-ready code branches which are otherwise hard to simulate on local environments as well as for general test reasons. Note that this environment is also used by some of our customers which are businesses experimenting with API integrations and/or trying out our system in some other ways. Making changes to certain system elements might be visible for those customers (e.g. via Marketplace) and therefore we insist on following rules:\u003c/p\u003e\n\n\u003cul\u003e\n\u003cli\u003eDo not create an infinite amount of certain entities, e.g. vendor accounts. If you managed to find a gap where such entities are allowed to be created without reasonable limit, you must stop early and let us know\u003c/li\u003e\n\u003cli\u003eSome of these entities are displayed for our customers in certain contexts. Refrain from profanity or other offensive language\u003c/li\u003e\n\u003cli\u003eIf you want to test illegal data access between different multi-tenant accounts (IDOR etc) please create accounts on your own without harnessing existing accounts\u003c/li\u003e\n\u003c/ul\u003e\n\n\u003cp\u003eOur system exposes the ability to have embeddable widgets. Widgets are publicly accessible resources and are made accessible via widget.bokuntest.com. Similar to this, we provide a \u003ca href=\"https://bokun.github.io/api-docs/\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003epublic RESTful API\u003c/a\u003e via api.bokuntest.com. We’re happy to work with you in providing more details for how to create relevant entities and access these both endpoints. Alternatively, consult our \u003ca href=\"https://docs.bokun.io/docs/bokun-help-center\" rel=\"nofollow noreferrer\" target=\"_blank\"\u003ehelpdesk page\u003c/a\u003e as creating widgets / using API should hopefully not be too complicated.\u003c/p\u003e","rewardRangeData":{},"recentChangeFlags":null},{"id":"8a4ebc62-205d-4e24-bf4e-04253bd165a3","name":"Out of Scope Targets","targets":[{"id":"da6df6c4-863d-4bb7-87fa-bd2ffc8f6612","uri":"","name":"*.bokun.eu","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"38072afb-9b80-4576-83d1-dd6f7fc8a598","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"da6df6c4-863d-4bb7-87fa-bd2ffc8f6612"}],"recentChangeFlags":null},{"id":"28656e9c-af64-4c4c-835d-ac0df0088c93","uri":"","name":"*.bokun.website","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"03b2a523-374e-406a-b74a-eae0da50c180","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"28656e9c-af64-4c4c-835d-ac0df0088c93"}],"recentChangeFlags":null},{"id":"52a411bc-f683-4211-9a0a-77bad6bb679d","uri":"","name":"*.bokun.tools","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"db8b798c-3c37-4811-927f-351060c1e63e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"52a411bc-f683-4211-9a0a-77bad6bb679d"}],"recentChangeFlags":null},{"id":"9177397f-905c-43cf-9b84-3d500037f062","uri":"","name":"*.bokun.team","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"44f14ee5-2f0a-4242-83d0-b7205be3df7e","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9177397f-905c-43cf-9b84-3d500037f062"}],"recentChangeFlags":null},{"id":"cbf40dbf-ceb7-47f3-9e9e-b3743532710b","uri":"","name":" ir.tripadvisor.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"cdd34c67-583f-4441-b8d2-152ccd9f7205","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"cbf40dbf-ceb7-47f3-9e9e-b3743532710b"}],"recentChangeFlags":null},{"id":"37883d29-4a5b-452d-809d-357fa647afe1","uri":"","name":"*.tripadviser.at","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a822dfaa-414d-40eb-b7b2-47cef02f6b79","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"37883d29-4a5b-452d-809d-357fa647afe1"}],"recentChangeFlags":null},{"id":"81b52e53-4650-410f-920c-1abfcc6ddb1f","uri":null,"name":"*.tripadvisor.cn","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"f4cbe291-6b53-450d-b8b9-cb3d099186d7","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"81b52e53-4650-410f-920c-1abfcc6ddb1f"}],"recentChangeFlags":null},{"id":"f3ae049e-bb97-49fa-9893-4ee3c9e37c3a","uri":"","name":"*.tripadvisor.*/Trips","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"1950274c-be2a-4d60-a0a9-14c831646cbc","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"f3ae049e-bb97-49fa-9893-4ee3c9e37c3a"}],"recentChangeFlags":null},{"id":"a16ffe5d-89f2-41a3-98de-2917c15dcb00","uri":"","name":"*.tripadvisor.*/Mobile*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"bddeebf6-443d-4a80-8a6d-c7c6c4098aa5","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a16ffe5d-89f2-41a3-98de-2917c15dcb00"}],"recentChangeFlags":null},{"id":"976f1e6d-24ec-4c9e-8fa2-4aaf2f9cc4d9","uri":null,"name":"*.tripadvisor.*/engineering","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"774931bc-c3db-49f9-9d72-bd29e2062aab","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"976f1e6d-24ec-4c9e-8fa2-4aaf2f9cc4d9"}],"recentChangeFlags":null},{"id":"473bee92-238b-4896-892e-0bc7ca810f1d","uri":"","name":"*.tripadvisor.*/WidgetEmbed-*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"2fac5dc0-7e8a-438b-af09-756318410870","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"473bee92-238b-4896-892e-0bc7ca810f1d"}],"recentChangeFlags":null},{"id":"02832321-568b-4566-a0d4-5e6a3562acf9","uri":"","name":"spotlight-dev.tripadvisor.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"45c10935-cd81-4ed5-bf47-7325bc035ec5","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"02832321-568b-4566-a0d4-5e6a3562acf9"}],"recentChangeFlags":null},{"id":"4ef6d755-46dd-4f9b-8ccd-567f78a9875e","uri":"","name":"spotlight.tripadvisor.*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"147bd4f8-feac-40d2-acbe-47effd0d8f9a","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"4ef6d755-46dd-4f9b-8ccd-567f78a9875e"}],"recentChangeFlags":null},{"id":"584ab92b-6b48-4261-bf5d-e5ac78e1d978","uri":null,"name":"careers.tripadvisor.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d96a967c-0df9-4ff6-a5b9-484d46c3cb7b","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"584ab92b-6b48-4261-bf5d-e5ac78e1d978"}],"recentChangeFlags":null},{"id":"627d6c0b-0c3c-4c38-ac2e-a0e17f156abd","uri":null,"name":"*.tripadvisoradexpress.*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"aeddec6f-704b-4b39-bd20-5392264af9ba","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"627d6c0b-0c3c-4c38-ac2e-a0e17f156abd"}],"recentChangeFlags":null},{"id":"220b6794-9cc8-4230-910d-58cee30a3441","uri":null,"name":"*.tripadvisorwifi.*","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"caf9503b-015f-4431-8050-d93846832962","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"220b6794-9cc8-4230-910d-58cee30a3441"}],"recentChangeFlags":null},{"id":"a11eaa13-f1c5-42cb-ac92-dcc3c781e0ad","uri":"","name":"*.bokun.io","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"236abf2a-31e0-4856-b50f-7067f132bd47","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"a11eaa13-f1c5-42cb-ac92-dcc3c781e0ad"}],"recentChangeFlags":null},{"id":"9b2009b9-415c-47e6-9612-667cf1efe4aa","uri":"","name":"*.bokun.is","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"70579a4e-b09f-4d76-93a7-a43cc18b69fe","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"9b2009b9-415c-47e6-9612-667cf1efe4aa"}],"recentChangeFlags":null},{"id":"8ca2d3de-acbe-4430-a983-a052c9a6e8cb","uri":"","name":"*.bokun.com","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"754968a2-43d5-4207-a0e5-c0a55c49af54","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"8ca2d3de-acbe-4430-a983-a052c9a6e8cb"}],"recentChangeFlags":null},{"id":"7d3a7cfa-9784-448c-9208-d2b9f46b7d87","uri":"","name":"*.bokun.app","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"d8df5d77-ee9b-4912-90bb-d4d5aaff6aab","sortOrder":0},"sortOrder":0,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"7d3a7cfa-9784-448c-9208-d2b9f46b7d87"}],"recentChangeFlags":null},{"id":"09ddb378-c14a-48d0-a26d-f9a7aa4f5533","uri":"","name":"taplus.*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"97400aa9-a88d-4eb8-9aab-51205b31ba2c","sortOrder":22},"sortOrder":22,"tags":null,"recentChangeFlags":null},{"id":"104a3333-d884-46bf-80c0-e45b7008746f","uri":"","name":"tripadvisor-plus.*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"5231559b-77b2-49b0-b589-57329f6714eb","sortOrder":23},"sortOrder":23,"tags":null,"recentChangeFlags":null},{"id":"50305fd7-8d70-490a-8051-efe7d71e27cd","uri":"","name":"tripadvisorplus.*","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"b0bf128a-a6dd-4a99-9e0d-d76089d5d183","sortOrder":24},"sortOrder":24,"tags":null,"recentChangeFlags":null},{"id":"51c0d20d-2157-40f2-b226-1962b27a1500","uri":"","name":"*.experiences.zone","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"a0ed1db2-b173-4bfd-ad61-137e0c032a2e","sortOrder":24},"sortOrder":24,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"51c0d20d-2157-40f2-b226-1962b27a1500"}],"recentChangeFlags":null},{"id":"eaabbc83-b1e4-4f80-914a-752edefac6f3","uri":"","name":"travelermail.com","category":"website","ipAddress":"","description":null,"engagementBriefTargetGroupTarget":{"id":"45504b09-8bf0-4221-977f-e766f64ac3fa","sortOrder":25},"sortOrder":25,"tags":null,"recentChangeFlags":null},{"id":"39a5111b-2cd7-449a-99d5-325487e0208c","uri":"","name":"*.bokunmobile.website","category":"website","ipAddress":null,"description":null,"engagementBriefTargetGroupTarget":{"id":"e6e44fdf-43ba-44a4-8121-4453dfafbdac","sortOrder":25},"sortOrder":25,"tags":[{"id":"bc744424-2ab8-48c8-b938-c6d6abcdf500","name":"Website Testing","targetId":"39a5111b-2cd7-449a-99d5-325487e0208c"}],"recentChangeFlags":null}],"inScope":false,"sortOrder":6,"description":null,"rewardRange":null,"descriptionHtml":null,"rewardRangeData":{},"recentChangeFlags":null}],"resources":[{"id":"9d770bc3-44b6-4b40-840a-b37c69e079d1","attachmentPath":"https://bugcrowd.com/engagements/tripadvisor-bb-og/attachments/9d770bc3-44b6-4b40-840a-b37c69e079d1","name":"burp-config-tripadvisor-scope.json","filename":"burp-config-tripadvisor-scope.json","description":"BurpSuite project configuration file with scope configured. ","icon":"fileOther","size":28091,"sizeLabel":"27.4 KB","uploadedAt":"23 Sep 2024","fileType":"Document","embedUrl":"https://bugcrowd.com/engagements/tripadvisor-bb-og/attachments/9d770bc3-44b6-4b40-840a-b37c69e079d1"}],"engagement":{"id":"2f960334-69c2-4280-b30c-6977369516eb","code":"tripadvisor-bb-og","state":"in_progress","endsAt":null,"bountyId":"8c6145e0-2257-4323-857f-5df066613b56","startsAt":"2019-01-14T17:00:00Z"},"vrtScopeRules":[],"engagementConfiguration":{"participation":"open","crowdSelectionStrategy":"none"}},"industryName":"Technology","methodologyName":null,"logoUrl":"https://logos.bugcrowdusercontent.com/logos/85e6/3f88/041fa6d4/6ee5239552ab10b10c5406f689f53a36_tripadvisor_.jpeg","logoBackgroundColor":"#1e201f","displayDisclosureTerms":true,"coordinatedDisclosure":true,"collaborationEnabled":true,"participation":"open","rewardAllocation":"pay_for_success","engagementTypeDetail":{"iconVariant":"bug-bounty","productLabel":"Bug Bounty","timeboxed":false},"pausedReason":null,"lastTransitionAt":"2019-01-14T17:00:00.000Z","cancellationReason":null,"statusLabel":"In progress","routesPaths":{"brief":"/engagements/tripadvisor-bb-og","changelogs":"/engagements/tripadvisor-bb-og/changelog","submissions":null,"announcements":"/engagements/tripadvisor-bb-og/announcements","hallOfFame":"/engagements/tripadvisor-bb-og/hall_of_fames","crowdstream":"/engagements/tripadvisor-bb-og/crowdstream"},"announcementsCount":15,"knownIssuesEnabled":true,"isDemo":false,"serviceLevel":"Platform","submitReportUrl":"/engagements/tripadvisor-bb-og/submissions/new","methodologyUrl":null,"progressPercentage":0,"badgeVariant":null,"userBannedFromEngagement":null,"isLoggedIn":false,"loginUrl":"/user/sign_in","scopedSubmissionsUrl":"/submissions?engagement%5B%5D=tripadvisor-bb-og\u0026sort%5B%5D=submitted-desc","isFollowing":null,"credentialsUrl":null,"toggleSubscriptionUrl":"/tripadvisor-bb-og/engagement_subscribers","engagementChangelogsUrl":"/engagements/tripadvisor-bb-og/changelog","publishedAt":"2026-03-06T15:17:09.231Z","engagementChangelogUrl":"/engagements/tripadvisor-bb-og/changelog/cfe0ee72-f35a-498c-aefc-997075164376","createUserFeedbacksUrl":"/engagements/tripadvisor-bb-og/feedbacks","engagementCrowdstreamUrl":"/engagements/tripadvisor-bb-og/crowdstream","acceptedSubmissionsEnabled":true,"disclosedReportsEnabled":true,"engagementsUrl":"/engagements","engagementPaymentDetailUrl":null,"shouldShowHideButton":false,"engagementHiddenData":{},"totalRewardPool":null,"vrtScopeRules":{"data":[]},"vrtVersion":"1.19.1","isSubmissionPublishThrottled":false,"showIdVerificationAlert":false,"identityVerificationSettingsUrl":"https://bugcrowd.com/h/settings/identity_verification","identityUrl":null}