Description

Flemish Radio and Television Broadcasting Organization bugbounty program

Bounties
Low
0.1 - 3.9
Medium
4.0 - 6.9
High
7.0 - 8.9
Critical
9.0 - 9.4
Exceptional
9.5 - 10.0
Tier 2
25
200
500
1,100
1,500
Tier 2
€25 - €1,500
Rules of engagement
Required
Not applicable
max. 5 requests/sec
Not applicable

Our promise to you

  • We will respond to report as soon as possible!
  • We are happy to respond to any questions, please use the button in the right top corner for this.
  • We respect the safe harbour clause that you can find below

Your promise to us

  • Provide detailed but to-the point reproduction steps
  • Include a clear attack scenario. How will this affect us exactly?
  • Remember: quality over quantity!
  • Please do not discuss or post vulnerabilities without our consent (including PoC's on YouTube and Vimeo)
  • Please do not use automatic scanners -be creative and do it yourself! We cannot accept any submissions found by using automatic scanners. Scanners also won't improve your skills, and can cause a high server load (we'd like to put our time in thanking researchers rather than blocking their IP's 😉)
  • Don't use the following methods as these are our production environments:
    • Bruteforce username/password logins
Domains

vrtnws-api.vrt.be

Tier 2
URL

A collection of API's used for the VRT NWS product

Tier 2
iOS
Tier 2
iOS

4ever.ketnet.be

Tier 2
URL

api.sporza.be

Tier 2
URL

A collection of different API endpoints used on the sporza.be website.

api.vrt.radio

Tier 2
URL

the api domain for VRT radio sites

Tier 2
Android
Tier 2
Android

bff.ketnet.be

Tier 2
URL

cds.vrt.radio

Tier 2
URL

the cds domain for VRT radio sites

content.ketnet.be

Tier 2
URL

Please keep automated scans at max 3 requests/second here at the moment, we're aware of performance issues leading to outages on this domain if amount of 400's gets too high in a short time period.

data.ketnet.be

Tier 2
URL

dedokterbeashow.ketnet.be

Tier 2
URL

juniormusical.ketnet.be

Tier 2
URL

kaatje.ketnet.be

Tier 2
URL

live-cf-vrt.akamaized.net

Tier 2
URL

This Akamai CDN subdomain delivers part of our video content. We want to know about CDN misconfiguration, but we will not accept issues that are unsolvable by VRT.

login.vrt.be

Tier 2
URL

magazine.ketnet.be

Tier 2
URL

media-services-public.vrt.be

Tier 2
URL

ondemand-vrt.akamaized.net

Tier 2
URL

This Akamai CDN subdomain delivers part of our video content. We want to know about CDN misconfiguration, but we will not accept issues that are unsolvable by VRT.

player.vrt.be

Tier 2
URL

privacy.ketnet.be

Tier 2
URL

profiel.vrt.be

Tier 2
URL

VRT-profile with Single Sign On implementation

remix-cf-vrt.akamaized.net

Tier 2
URL

This Akamai CDN subdomain delivers part of our video content. We want to know about CDN misconfiguration, but we will not accept issues that are unsolvable by VRT.

senior-bff.ketnet.be

Tier 2
URL

sport-components.sporza.be

Tier 2
URL

sporza.be

Tier 2
URL

Sporza is the brand of VRT used for sports.

stubru.be/luister/select

Tier 2
URL

Studio Brussel is a Dutch-speaking radio station in Belgium, owned by the VRT. This select scope is a first start, and will be extended in the future.

vrt.be/vrtnu

Tier 2
URL

VRT's online video platform. It allows its users to (re-)watch television programs of its brands één, Canvas and Ketnet on the internet.

To be able to fully use VRT NU, you have to register for a VRT profile. Using all of VRT NU's content is only possible for users with a Belgian residential address. Without the login, you can still watch the live channels.

vrt.be/vrtnws

Tier 2
URL

VRT NWS is the news brand of VRT. Informing the Flemish citizen is an essential part of it's job.

www.ketnet.be

Tier 2
URL

innovatie.vrt.be

Out of scope
URL

shop.*.be

Out of scope
URL
In scope

The VRT (Flemish Radio and Television Broadcasting Organization) considers it important that its information and systems are secure. If you have found a vulnerability in one of the items in scope, please let us know so that we can take measures as quickly as possible. We would like to work with you to protect our audience and our systems in a better way.

We also have a Responsible Disclosure Program, that applies to all VRT systems and domains. In case of doubt on the scope, please contact us to clarify matters.

For "Ketnet" we are specifically looking for:

Ways to impersonate another user
Ways to list registered users or obtain their data
Ways to alter the content visible on the site
Out of scope

Domains

  • All VRT domains not explicitily mentioned in the in scope domains, unless they are used in the natural flow for using the products.
  • gigya.com owned parts of the flow
  • qualtrics.com owned parts of the flow
  • shop.*.be
  • innovatie.vrt.be
  • Salesforce owned parts of the flow: https://www.vrt.be/heb-je-een-vraag/*

Application

  • API key disclosure without proven business impact
  • Wordpress usernames disclosure
  • Pre-Auth Account takeover/OAuth squatting
  • Self-XSS that cannot be used to exploit other users
  • Verbose messages/files/directory listings without disclosing any sensitive information
  • CORS misconfiguration on non-sensitive endpoints
  • Missing cookie flags
  • Missing security headers
  • Cross-site Request Forgery with no or low impact
  • Presence of autocomplete attribute on web forms
  • Reverse tabnabbing
  • Bypassing rate-limits or the non-existence of rate-limits.
  • Best practices violations (password complexity, expiration, re-use, etc.)
  • Clickjacking without proven impact/unrealistic user interaction
  • CSV Injection
  • Sessions not being invalidated (logout, enabling 2FA, etc.)
  • Tokens leaked to third parties
  • Anything related to email spoofing, SPF, DMARC or DKIM
  • Content injection without being able to modify the HTML
  • Username/email enumeration
  • Email bombing
  • HTTP Request smuggling without any proven impact
  • Homograph attacks
  • XMLRPC enabled
  • Banner grabbing/Version disclosure
  • Not stripping metadata of files
  • Same-site scripting
  • Subdomain takeover without taking over the subdomain
  • Arbitrary file upload without proof of the existence of the uploaded file
  • Blind SSRF without proven business impact (pingbacks are not sufficient)
  • Disclosed/misconfigured Google Maps API keys
  • Host header injection without proven business impact
  • Data visibility within a shared family account (between child profiles or between child and parent profiles)
  • bypass of email validation while creating account on ketnet.be

General

  • In case that a reported vulnerability was already known to the company from their own tests, it will be flagged as a duplicate
  • Theoretical security issues with no realistic exploit scenario(s) or attack surfaces, or issues that would require complex end user interactions to be exploited
  • Spam, social engineering and physical intrusion
  • DoS/DDoS attacks or brute force attacks
  • Vulnerabilities that only work on software that no longer receive security updates
  • Attacks requiring physical access to a victim's computer/device, man in the middle or compromised user accounts
  • Recently discovered zero-day vulnerabilities found in in-scope assets within 14 days after the public release of a patch or mitigation may be reported, but are usually not eligible for a bounty
  • Reports that state that software is out of date/vulnerable without a proof-of-concept
  • The use of 3rd party malicious apps for stealing credentials

Mobile

  • Shared links leaked through the system clipboard
  • Any URIs leaked because a malicious app has permission to view URIs opened
  • The absence of certificate pinning
  • Sensitive data in URLs/request bodies when protected by TLS
  • Lack of obfuscation
  • Path disclosure in the binary
  • Lack of jailbreak & root detection
  • Crashes due to malformed URL Schemes
  • Lack of binary protection (anti-debugging) controls, mobile SSL pinning
  • Snapshot/Pasteboard leakage
  • Runtime hacking exploits (exploits only possible in a jailbroken environment)
Severity assessment

This program follows Intigriti's contextual CVSS standard

FAQ

Can I create a test account?

Yes and you are encouraged to do so! Please use your @intigriti.me email address for the account creation. More info can be found here: https://kb.intigriti.com/product-features/intigritime

Can I create a test account for KETNET?

Yes and you are encouraged to do so! Since this is a website for children, the onboarding process involves ensuring a parent agrees:

Registration URL: https://www.ketnet.be/user/register
Fill in "Voornaam" (First Name)
Fill in "Gebruikersnaam" (username, must be unique)
Click "Ik ga mijn ouders halen" (I will get my parents)
Fill in your @intigriti.me email address (more info can be found here: https://kb.intigriti.com/product-features/intigritime).
Use this GSM number: +32 0400000000 (you can also use your own number, if you want)
Validate the email-address by following the link than was sent to you
The SMS code is 538638. (If you used your own number, use the code you received)
Complete the rest of the registration
All aboard!
Please log in or sign up on the platform

For obvious reasons we can only allow submissions or applications for our program with a valid Intigriti account.

It will only take 2 minutes to create a new one or even less to log in with an existing account, so don't hesitate and let's get started. We would be thrilled to have you as part of our community.

Researchers
last contributors
logo
logo
logo
logo
logo
logo
leaderboard
logo
logo
logo
logo
logo
logo
Overall stats
submissions received
215
average payout
N/A
accepted submissions
54
total payouts
N/A
Last 90 day response times
avg. time first response
< 2 days
avg. time to decide
+3 weeks
avg. time to triage
< 4 days
Activity
2/21
VRT
closed a submission
2/19
VRT
closed a submission
2/16
VRT
closed a submission
2/16
VRT
accepted a submission
2/16
VRT
accepted a submission
2/15
logo
created a submission
2/11
logo
created a submission
2/11
logo
created a submission
2/7
VRT
changed the out of scope
1/30
logo
created a submission