projectdiscovery / public-bugbounty-programs

Community curated list of public bug bounty and responsible disclosure programs.

Public BugBounty Programs

Community curated list of public bug bounty and responsible disclosure programs.

The chaos-bugbounty-list.json file serves as the central management system for the public bug bounty programs displayed on chaos.projectdiscovery.io. We welcome your contributions to this list. If there are specific programs for which you'd like to see reconnaissance data, please submit a pull request.

We are currently accepting submissions in JSON format. Here's an example of the structure we require:

{
   "name":"HackerOne",
   "url":"https://hackerone.com/security",
   "bounty": true,
   "swag": true,
   "domains":[
      "hackerone.com",
      "hackerone.net",
      "hacker101.com",
      "hackerone-ext-content.com"
   ]
}

Your contributions will help us to continually improve and expand the range of public bug bounty programs we feature.

💬 Discussions

For any inquiries, suggestions, or topics you'd like to discuss, we encourage you to initiate a "Discussion" using our GitHub Discussions platform.

👨‍💻 Community

We invite you to join our Discord Community for more interactive discussions.
Stay updated with our latest news and activities by following ProjectDiscovery on Twitter.
For direct communication, feel free to reach us at [email protected].

📋 Guidelines

• Please note that only domain name values are accepted in the domains field.
• We do not support wildcard inputs such as *.tld or *.tld.*.
• The domains field should include TLD names associated with the target program, not necessarily based on the scope of the program.
• Subdomains are populated using our dataset Passive API

📌 References

• https://github.com/arkadiyt/bounty-targets-data
• https://github.com/disclose/diodb/blob/master/program-list.json
• https://firebounty.com

We greatly appreciate your contributions and your efforts in keeping our community dynamic and engaging. ❤️

public-bugbounty-programs's Issues

GitHub Action workflow to detect duplicate domains

New action workflow to detect duplicate domains in PR.

Expected flow -

if jq -r .programs[].domains[] chaos-bugbounty-list.json | wc is not equals to jq -r .programs[].domains[] chaos-bugbounty-list.json | sort -u | wc, workflows should fail.

Adding public BBP/VDP programs to list

The idea is to compile a list of publicly available bbp/vdp programs in a structured manner that can be consumed by a program to index subdomains of given domain and publish it at https://chaos.projectdiscovery.io

Format

{
   "name":"HackerOne",
   "url":"https://hackerone.com/security",
   "bounty": true,
   "swag": true,
   "domains":[
      "hackerone.com",
      "hackerone.net",
      "hacker101.com",
      "hackerone-ext-content.com"
   ]
}

Reference

https://github.com/arkadiyt/bounty-targets-data
https://github.com/disclose/diodb/blob/master/program-list.json
https://firebounty.com

Remove cbs.nl from it

Because it's not a bug bounty program

No results are returned for getwindstream.com

I made a pull request for adding the wind stream program in public-bugbounty-programs, and my PR got merged. But in https://chaos.projectdiscovery.io/#/ the Subdomains for winddtream shows 0.

chaos -d getwindstream.com -count

Support for CIDR/IP input

Example input:-

{
   "name":"HackerOne",
   "url":"https://hackerone.com/security",
   "bounty":true,
   "swag":true,
   "domains":[
      "hackerone.com",
      "hackerone.net",
      "hacker101.com",
      "hackerone-ext-content.com"
   ],
   "network":[
      "66.232.20.0/23",
      "206.166.248.0/23",
      "66.232.20.1"
   ]
}

Question- Defining program scope?

It is getting more common for programs to have an *.sub.example.com scope. Would these be valuable/relevant to add to this list if they don't have a *.example.com scope, too?

Also, many programs will list a wildcard subdomain scope (*.example.com) but then list specific subdomains as out of scope. Is there a way to define these? They can change often so it may be best to leave it as is, and for researchers to verify the current program scope before testing (which hopefully they already do).

Program doesn't show up on https://chaos.projectdiscovery.io/#/

Hi,

I opened a PR as you can see from here: #450 and it is merged. Although I saw the program on the site for the first few days, I couldn't see it afterwards. Is there a bug here?

Also, this problem is occurred more than one program as I can see. I search for "Agicap", "Sendcloud" etc. and can't see any result on https://chaos.projectdiscovery.io/

GitHub Action workflow to detect non accessible program urls

To avoid adding or keeping programs of which the program policy is not accessible publicly or changes with time, we can add automation preferably using httpx to match for 200 status code for the followings -

• Check for newly program URLs added in each Pull request.
• Check for all program URLs in bbp list with scheduled GH workflow run.

Test should be failed for URLs with non 200 status code.

Anything else

#462

Add JSON schema and validation

From #703, would be good to have a defined JSON schema and then use something like https://github.com/marketplace/actions/validate-json to validate that schema on all PRs

Improve the JSON sorting workflow

The sorting itself should be case insensitive and as easy as:

fetch('https://cdn.jsdelivr.net/gh/projectdiscovery/public-bugbounty-programs@master/chaos-bugbounty-list.json')
.then(response => response.json())
.then(data => {
    data.programs.sort(function(a,b) { return a.name.toLowerCase() > b.name.toLowerCase() })
    return data
})
.then(data => console.log(JSON.stringify(data)))

Current workflow: https://github.com/projectdiscovery/public-bugbounty-programs/blob/master/.github/workflows/json-sorting.yml

GitHub Action workflow to detect invalid domain input

New action workflow to detect invalid domain input in PR

As per allowed json spec:

{
   "name":"HackerOne",
   "url":"https://hackerone.com/security",
   "bounty": true,
   "swag": true,
   "domains":[
      "hackerone.com",
      "hackerone.net",
      "hacker101.com",
      "hackerone-ext-content.com"
   ]
}

domains fields should only contain root domain names, not subdomain, URLs, wildcard or anything except root domain name.

Workflows should detect and fail upon invalid domain input under domains block for incoming PRs

Ability to exclude out of scope subdomain

Hi,

A lot of program has out of scope subdomain. Testing on these subdomains are prohibited.

As you can see below, these programs on Chaos have millions of enumerated subdomain where 99% are out of scope :

Adding JSON validator check on PR and push request

Like we have in nuclei-templates for YAML.

Support for TLD scope

Hi,

Some companies or organization have their own TLD where every domain are in scope. These are called Brand TLDs.

Example:

• DoD: *.mil
• Apple: *.apple

You can find all brand TLDs here : https://brandtld.news/tld/

Typo causes paresing error with json

public-bugbounty-programs/chaos-bugbounty-list.json

Line 4183 in a0915f8

"domain":[

• This should be altered to domains

Bug in `ValidateFQDN` function

from https://github.com/projectdiscovery/public-bugbounty-programs/blob/main/pkg/dns/dns.go#L27-L36

func ValidateFQDN(value string) bool {
	// check if domain can can be parsed
	tld, err := publicsuffix.EffectiveTLDPlusOne(value)
	if err != nil {
		return false
	}

	// check if top level domain is equal to original and it's a valid domain name
	return tld == value && govalidator.IsDNSName(tld)
}

flagging ngrok.io as invalid domain - https://github.com/projectdiscovery/public-bugbounty-programs/actions/runs/5364609119/jobs/9732904993

https://hackerone.com/ibb-data page not found

public-bugbounty-programs/chaos-bugbounty-list.json

Line 1691 in db19e04

"name": "Data Processing (IBB)",

Request for new tab feature

Hi Team

Can we have a feature tab like swag

Just like we have rewards , no rewards

Porting disclose.io programs list to chaos

URL:- https://raw.githubusercontent.com/disclose/diodb/master/program-list.json

Double entry for strongdm

First one at

public-bugbounty-programs/chaos-bugbounty-list.json

Line 88 in 5a84288

"name": "strongdm",

Second one at

public-bugbounty-programs/chaos-bugbounty-list.json

Line 4822 in 5a84288

"name":"StrongDM",

Adding Hackerone Program To List - SideFX

{ "name": "sidefx", "url": "https://hackerone.com/sidefx", "bounty": true, "domains": [ "sidefx.com" ] }

Porting public programs with wildcard scope

Source:- https://github.com/arkadiyt/bounty-targets-data/blob/master/data/wildcards.txt

This is a good source, but need to find a way to differentiate the program name, so it can be added in the expected format.

add eTLD validation support

Description

usually eTLD's don't resolve to ip . since its general use case is to act like TLD however lot of orgs host services on eTLD.
Example below are eTLD and some of them have resolve which some not

echo -e "ngrok.io\nco.uk\nai" | dnsx -resp

      _             __  __
   __| | _ __   ___ \ \/ /
  / _' || '_ \ / __| \  / 
 | (_| || | | |\__ \ /  \ 
  \__,_||_| |_||___//_/\_\

		projectdiscovery.io

[INF] Current dnsx version 1.1.4 (latest)
ngrok.io [34.210.2.84] 
ai [209.59.119.34] 

ValidateFQDN function used for validation of root domains does not consider this use case which classifies ngrok.io and ai as invalid domains here but some of them are valid (ex: http://ai 😆 )

Proposed Changes

• for proper validation check if given domain is eTLD if so try to resolve it using retryabledns if resolved then it is considered as valid domain if not then it is suffix(i.e not valid for this repo)

add dod list of subs

*.mil add these to chaos dod subs hackerone

Feature: add intigriti

Hi, what does one need to do to get intigriti.com results in chaos?