Banner object (1)

Hack and Take the Cash !

833 bounties in database
  Back Link to program      
10/10/2019
Ibotta logo
Thanks
Gift
Hall of Fame
Reward

Reward

100 $ 

Ibotta

All domains/properties owned by Ibotta are in scope. Please take care when testing on production not to compromise the functioning of any Ibotta assets or users on the platform.

Ibotta continuously pushes out new code. The web APIs are updated daily, and the mobile app is updated bi-weekly. In the event you don't find anything today, there may be something present tomorrow. This is a great opportunity for Ibotta and the researcher community to work together to find vulnerabilities!

Rating Taxonomy

This program adheres to the Bugcrowd Vulnerability Rating Taxonomy for the prioritization of findings.

Rewards:

$ | iOS, Android, API | Web
---|---|---
P1 | $5,000 | $1,500
P2 | $2,250 | $900
P3 | $750 | $300
P4 | $250 | $100

Targets

In scope

Target name | Type
---|---
<http://ibotta.com> | Website
<https://backend.ibotta.com/> | Website
<https://content-server.ibotta.com/graphql> | API
<https://api.ibotta.com> | API
<https://api.ibops.net> | API
<https://api.int.ibops.net> | API
<https://api.int.ibops.net/customer-loyalty-service> | API
https://api.ibops.net/ad-management | API
<http://market.android.com/details?id=com.ibotta.android> | Android
<http://itunes.apple.com/us/app/ibotta/id559887125> | iOS
Ibotta App Data & Memory | Other

Out of scope

Target name | Type
---|---
<http://sampling.ibotta.com/> | Website
<https://backend.ibotta.com/duplicate_receipt_moderation> | API

Access

Researchers can self register for an account using your @bugcrowdninja.com email address. For more info regarding @bugcrowdninja email addresses, see here.

Researchers will need to have a rewards account on any of these grocery chains. These will not be provisioned by Bugcrowd or Ibotta.

Only test on Ibotta owned assets. Third party tools and services which are not maintained by the Ibotta team are considered out of scope. All testing must abide by AWS's rules on penetration testing.

Account Flow:

The below documentation contains information regarding how to initiate and use the flow of the application, and API endpoint data and examples. We also have included a video on how to initiate and use the flow.

Geo Restrictions

Ibotta is currently for US use only. International researchers are welcome to test against Ibotta assets but must do so through a US IP address (through a self provisioned proxy/vpn).

Focus Areas

  1. Any ability for an attacker to sniff Grocery retailers credentials entered into Ibotta.
  2. All phone logs, especially exceptions, need to be verified to not include credentials.
  3. Check for plaintext customer sensitive information sent to 3rd party from our endpoints.
  4. Input validation for database access for protection against injection.
  5. Test the restriction of HTTP methods to those we are in control of, or any attack vector against our endpoints.
  6. 2FA bypass and/or compromising account integrity.
  7. Cashout threshold and value manipulation.

Technology

  • The mobile apps are both native
  • Servers are Ruby/Rails on Ubuntu
  • Hosted on AWS, API endpoints behind Elastic LoadBalancer
  • Infrastructure includes Memcache, Redis and MySQL

Cash out

A key use case for the Ibotta application is cashing out. For testing cash out in this program please be aware of the following:

  • Paypal, Venmo, and giftcard cashout methods are live. Because of this, accounts will not be funded again.
  • Cashout thresholds are reduced for the bugcrowd provisioned accounts to facilitate testing.
  • SMS authentication is enabled for all accounts. Because of fraud scoring, VoIP numbers (Google Voice, etc) may be blocked.
  • Critical requests are rate-limited and geoip filtered. Requests from outside the US are not likely to be allowed.

Out-of-Scope

  • Testing of third-party services used by Ibotta, except where explicitly permitted as 'In Scope'
  • No attacks/tests of any kind should be performed on the Grocery websites/properties
  • Creating counterfeit receipts and barcodes
  • Double submission of receipts
  • Other customer-support situations
  • Denial of Service via high rate requests or other nonstandard requests
  • Lack of source code obfuscation (ios-class-guard, ProGuard) for mobile apps

Safe Harbor:

When conducting vulnerability research according to this policy, we consider this research to be:

  • Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or similar state laws), and we will not initiate or support legal action against you for accidental, good faith violations of this policy;
  • Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring a claim against you for circumvention of technology controls;
  • Exempt from restrictions in our Terms & Conditions that would interfere with conducting security research, and we waive those restrictions on a limited basis for work done under this policy; and
  • Lawful, helpful to the overall security of the Internet, and conducted in good faith.
  • You are expected, as always, to comply with all applicable laws.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via support@bugcrowd.com before going any further.

Program rules

This program follows Bugcrowd’s standard disclosure terms.

This program does not offer financial or point-based rewards for P5 — Informational findings. Learn more about Bugcrowd’s VRT.

In Scope

Scope Type Scope Name
android_application

http://market.android.com/details?id=com.ibotta.android

ios_application

http://itunes.apple.com/us/app/ibotta/id559887125

other

Ibotta App Data & Memory

web_application

https://backend.ibotta.com/

web_application

https://content-server.ibotta.com/graphql

web_application

https://api.ibotta.com

web_application

https://api.ibops.net

web_application

https://api.int.ibops.net

web_application

https://api.int.ibops.net/customer-loyalty-service

web_application

https://api.ibops.net/ad-management

web_application

http://ibotta.com

Out of Scope

Scope Type Scope Name
web_application

http://sampling.ibotta.com/

web_application

https://backend.ibotta.com/duplicate_receipt_moderation


This program have been found on Bugcrowd on 2019-10-10.

FireBounty © 2015-2019

Legal notices