We're an independent, not-for-profit membership organisation that supports the infrastructure of the Internet through technical coordination in our service region. Our most prominent activity is to act as the Regional Internet Registry (RIR) providing global Internet resources and related services (IPv4, IPv6 and AS Number resources) to members in our service region.
Validation times
We will validate all submissions within the below timelines, once your submission has been verified by Intigriti.
Submissions validated outside of this may be awarded a €25 bonus.
| Vulnerability Severity | Time to validate |
|---|---|
| Exceptional | 2 Working days |
| Critical | 2 Working days |
| High | 5 Working days |
| Medium | 15 Working days |
| Low | 15 Working days |
This remains at the discretion of the RIPE NCC to award.
Check our fix
We offer up to €50 bonus to verify a resolved issue for us (when requested).
This remains at the discretion of RIPE NCC to award.
access.ripe.net
This is the authentication service for our membership and community, mostly used for all of our membership (e.g. LIR) applications.
We strongly suggest you to adjust your scanners to the limit where we mentioned in the req/sec.
Please adhere to the out of scope rules below.
https://github.com/RIPE-NCC/rpki-commons
This library contains an implementation of an X.509 v3 certificate extension which binds a list of IP address blocks or prefixes to the subject of a certificate (IP Address Delegation Extension).
https://github.com/RIPE-NCC/rpki-core
This repository contains the source code for the RIPE NCC certification. We strive to publish as many components as possible with reasonable effort. Some elements or information are not included, either because of our threat model or because we can not publish them.
https://github.com/RIPE-NCC/whois
RIPE Database whois code repository.
lirportal.ripe.net
Our portal page for LIR's where they can access their information and more.
Since this portal designed to give access only to LIR's, you can't create an account.
Until then;
*.ripe.net
Our main domain.
We suggest you to check out of scope section of our program if you discover any vulnerabilities on this domain or it's subdomains.
To make your reports better, we suggest you to check the IP address of the asset you've found so you can understand the address if in scope or out of scope.
193.0.0.0/19 and 2001:67c:2e8::/48
This is our IP Range.
Since we are letting some people to host their content, there are some exclusions.
https://github.com/RIPE-NCC/rpki-monitoring
https://github.com/RIPE-NCC/rpki-publication-server
This is the RIPE NCC's implementation of RFC 8182 - The RPKI Repository Delta Protocol and a draft of RFC 8181 - A Publication Protocol for the Resource Public Key Infrastructure.
https://github.com/RIPE-NCC/rpki-ta-0
https://github.com/RIPE-NCC/rsyncit
Assets owned by RIPE NCC
*.anchors.atlas.ripe.net
These probes and anchors are not hosted in networks managed by the RIPE NCC, but in networks participating in the RIPE Atlas project. If you find any vulnerabilities for IP addresses associated with RIPE Atlas probes/anchors, you will need to report them to the security teams of the responsible network operators.
*.probes.atlas.ripe.net
These probes and anchors are not hosted in networks managed by the RIPE NCC, but in networks participating in the RIPE Atlas project. If you find any vulnerabilities for IP addresses associated with RIPE Atlas probes/anchors, you will need to report them to the security teams of the responsible network operators.
193.0.0.160/27
2001:67c:2e8:3::/64
Any *.ripe.net host that is located outside of the in-scope IP ranges
The RIPE NCC uses a number of SaaS provider where a *.ripe.net record may point to. However, these services are not maintained by the RIPE NCC and are not part of this Bug Bounty program. If you think a specific host may be in scope, please contact Intigriti Support
Any of the beta/dev environments
exams.ripe.net
RIPE Meeting network (2001:67c:64::/48 and 193.0.24.0/21)
ripe(1to87).ripe.net
Introduction
We are happy to announce our bug bounty program! We've done our best to clean most of our known issues and now would like to request your help to spot the ones we missed!
Feedback
Would you like to help us improve our program or have some feedback to share, please send your anonymous feedback here:
Program Feedback Link
Please note this form will be checked periodically and should not be used for submission or support queries.
Updates
We are continuously going to update our program details, follow it to get notified on recent changes.
Out of scope:
DNS zone transfers (XFER request) are excluded from the scope
The RIPE NCC has a number of public data repositories. These do not contain sensitive data and everything in there is really public - so no need to report them. The services include:
This program follows Intigriti's contextual CVSS standard
Though we are following the Intigriti's CVSS standart, business impacts may be different than the actual score.
Final decision will be made after our assesment and set accordingly.
You can self-register on the application but please don’t forget to use your @intigriti.me address.
If you have doubts about the bug you've found, you can contact Intigriti Support, so we can discuss together and let you know if you should submit the bug via here or not.
RIPE NCC Bug Bounty Programme can not be used by RIPE NCC Employees or any external consultants working for RIPE NCC.
For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.
It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.
