Ababen more rayuwa, Ayyukan Yanar Gizo, manhajojin SMS-Activate

Dokokin shiga cikin shirin Bug Bounty

Rajista da Tabbatarwa

• Rajista: don shiga cikin shirin, da farko kuna bukatar yin rajista a gidan yanar gizon sms-activate.ai Ku ba da asusunka na Telegram yayin aikin rajista don sauƙaƙe sadarwa;
• Tabbatarwa: Dole ku wuce ta hanyar aikin tabbatarwa don karbar biyan kuɗi. Za a tura maku cikakkun umarni ta hanyar Telegram idan an amince da rahotonku.

Gabatar da rahotanni

• Nazarin Dokokin: Kafin gabatar da rahotonku, da fatan za ku yi kokarin fahimtar dokokin shiga da nau'ikan raunukan da za a iya la'akari da su;
• Fom din Rahoto: yi amfani da fom din a shafin sms-activate.ai/bugbountyForm don gabatar da rahotonku. Rahotonku ya kamata ya kunshi bayani mai kyau game da raunin, matakan sake gwadawa, shaida (hoton allo, bidiyo) da kuma shawarwari don gyara shi;
• Karinn fayiloli: a haɗa ƙarin fayiloli don tabbatar da raunin idan akwai buƙata;

Tsarin duba rahotanni

Nau'ikan raunuka

Tabbatarwa da sirri

Biyan Kuɗi

Ka'idojin ɗabi'a

Appendix A

• IDOR (ana karbar rahotanni game da wannan nau'in rauni ne kawai a lokacin da yake da matakin tsanani mai girma; matakin tsanani yana ƙayyade shi ta hanyar ƙwararren mu lokacin da aka tabbatar da raunin);
• Kowane nau'in raunukan XSS, ban da Stored XSS (ana karbar rahotannin raunin Stored XSS dangane da muhimmancin albarkacin yanar gizo);
• Clickjacking;
• URI mai sake jagoranci maras tsaro;
• Jerin Bayanan Directory an kunna (passwords, backups) da Fallasar bayanan sirri (dangane da bayanan da aka fallasa; ana karbar rahotannin wannan rauni idan an sami bayanan masu mahimmanci);
• Yanayin debug an kunna, wanda baya fallasar bayanan masu mahimmanci;
• Raunukan CSRF, waɗanda aka gano a cikin aikin da ba shi da mahimmanci;
• Fallasar panel na gudanarwa (idan mai binciken kurakurai ya samo dashbord na gudanarwa, amma bai iya kwace asusun ba ko samun wasu bayanan masu mahimmanci);
• Gano Mai Amfani ba tare da fallasar bayanan masu mahimmanci ba;
• Saita Tsaro mara Daidaito, a yanayin da babu shaidar cewa barazanar ta faru;
• Ki yarda da bayar da sabis;
• Spam；
• Injiniyancin zamantakewa, wanda aka niyya ma'aikata, masu kwangila ko abokan ciniki;
• Kowane kokari na zahiri don samun damar shiga kadarori ko cibiyoyin bayanai
• Mai mallakar tsarin;
• Rahoton da aka kirkiro ta amfani da kayan aiki na atomatik da scanning;
• Kurakurai a cikin software na bangare na uku;
• Rashin headers na tsaro waɗanda ba kai tsaye ke haifar da rauni ba;
• Keta amincin SSL / TLS;
• Raunukan da ke shafar masu amfani da browsers da platforms da suka tsohu ko ba su da lasisi kawai;
• Manufar password da dawo da asusu, kamar ranar ƙarshe ta hanyar sake saitin ko ƙarfin password;
• Tsohon rikodin DNS, yana nufin tsarin da bai kasance na mai tsarin ba.