Bitexen Web & App: Program Info

• The first report for the same vulnerability is accepted.
• Reports for vulnerabilities already known by Bitexen are not accepted.
• Do not share the vulnerabilities found on other platforms without Bitexen's permission. Reports that are found to be shared will lose their reward.
• Reports sent for vulnerabilities specified as out of scope are not accepted.
• Care should be taken not to damage the systems and the confidentiality of personal data.
• Other user data should not be accessed or changed, and all tests should be performed with the accounts under your control. You can forward vulnerabilities that may authorize access to user data without verifying or only by verifying them on your own accounts.
• Social engineering methods (phishing, vishing, smishing, etc.) and physical attacks (computer theft, SIM card copying, etc.) should not be used. DoS attacks should not be attempted.
• Reports can be submitted in Turkish or English.
• All details about the vulnerability must be shared and a PoC must be given. You can access the sample report formats at report-templates page.
• In cases where chain security vulnerabilities are detected by using more than one security vulnerabilities, separate reporting can be made.

Reward Criteria

• Bitexen employees and their first degree relatives cannot win rewards.
• You must be at least 14 years old to be eligible for the reward.
• Detected vulnerabilities should not be shared publicly.
• There should be no legal obstacles to the giving of the reward

Safe Harbor

Bitexen will not take any legal action for researches and reports made in accordance with the rules specified on this page.

In case of sending a report, it is considered that the rights of the submitted content are transferred to Bitexen.

In case the security vulnerabilities in the reports submitted within the scope of the program are related to the products and services, network structures, systems, applications and information of third parties other than Bitexen, the relevant reports are not considered within the scope of the Bitexen Vulnerability Reporting Program and therefore the relevant third parties may initiate legal action in such a reporting situation and We would like to inform you that we, as Bitexen, are not responsible for the situation. Bitexen does not allow security research other than its own products and services and does not provide any person with an authorization in this regard.

You can access the document, which includes detailed rules and legal information about the Bitexen Vulnerability Reporting Program, from the page policy-details.

Happy hunting! ᕕ( ᐛ )ᕗ

Bitexen Vulnerability Reporting Program has been prepared to receive controlled news about security vulnerabilities that may be found in our systems and to encourage researchers. If you think that the security of your Bitexen account has been compromised, change your password as soon as possible and contact our support team via [email protected].

Testing and Reporting

You can help us by following the methods below so that we do not confuse the traffic generated during your tests with the attacker traffic.

• You can use custom HTTP headers. (Example: X-BTXN-VDP: )
• You can specify your IP address in the report.

Be sure to only use accounts that you control during the testing process. If you have found a vulnerability to run commands on systems, just use the id andhostname commands. Do not use automated tools. If you have found a potentially damaging vulnerability, contact us to obtain additional testing permissions before verifying.

Allowed/not allowed actions for remote code execution vulnerabilities:

• Allowed * Harmless command attempts on input fields on the web frontend (such as whoami`, hostname,ifconfig) * File uploads that run a harmless command as hard-coded * Commands id andhostname for proof of exploited vulnerability
• Not Allowed * File uploads (webshell etc.) that can lead to free command execution * File deletion, editing, changing permissions * Actions that may affect normal operations (reboot etc.) * Commands and file accesses executed other than those required for proof of vulnerability

The following information should also be provided when reporting remote code execution vulnerabilities:

• Source IP address, destination IP address and port information
• Timestamp
• Requests and responses to the server
• Files and directories that were accessed intentionally or unintentionally during the test.