Live Nation

{
  "id": 0,
  "url": "https://hackerone.com/live_nation",
  "name": "Live Nation",
  "handle": "live_nation",
  "targets": {
    "in_scope": [
      {
        "asset_type": "URL",
        "instruction": "We are interested in Authentication Vulnerabilities ",
        "max_severity": "critical",
        "asset_identifier": "app.livenation.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "We are interested in API and Authentication Vulnerabilities ",
        "max_severity": "critical",
        "asset_identifier": "app.ticketmaster.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "We are interested in API and Authentication Vulnerabilities ",
        "max_severity": "critical",
        "asset_identifier": "app.ticketmaster.co.uk",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "We are interested in API and Authentication Vulnerabilities ",
        "max_severity": "critical",
        "asset_identifier": "app.ticketmaster.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "We are interested in API and Authentication Vulnerabilities ",
        "max_severity": "critical",
        "asset_identifier": "app.ticketmaster.com.au",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "We are interested in API and Authentication Vulnerabilities ",
        "max_severity": "critical",
        "asset_identifier": "app.ticketmaster.com.mx",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "We are interested in API and Authentication Vulnerabilities ",
        "max_severity": "critical",
        "asset_identifier": "app.ticketmaster.eu",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "We are interested in API and Authentication Vulnerabilities",
        "max_severity": "critical",
        "asset_identifier": "app.ticketmaster.ie",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "dk.royalarena.app",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "frontgatetickets.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "https://apps.apple.com/no/app/royal-arena/id1181913144",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": null,
        "max_severity": "critical",
        "asset_identifier": "https://apps.apple.com/us/app/ticketmaster-buy-sell-tickets/id500003565",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "# Bug Bounty Campaign: Persona & ASU Sign-Up Verification Testing\n\n## Overview\n\nWe are launching a focused testing campaign inviting our security researcher community to evaluate the identity verification controls on our Artist Sign-Up (ASU) flow. This campaign was created in direct response to community reports suggesting that verification steps in this flow may be bypassable.\n\n## Test Target\n\n**URL:** https://signup.ticketmaster.com/bugbountytest\n\nThis is a dedicated test event set up specifically for this campaign. It is live on our production infrastructure but isolated so that testing against it does not cause any operational impact. Please limit your testing activity to this URL only. Testing against any other live event or production sign-up flow is out of scope and outside the terms of our bug bounty program.\n\n## What to Focus On\n\nThis campaign accepts submissions for the following two areas only:\n\n* Bypassing Persona identity verification during the sign-up process\n* Bypassing the ASU (Artist Sign-Up) screen itself\n\nThese are the only submissions we will accept for this campaign. Findings outside of these two areas will not be accepted under this campaign.\n\nFor this test event, verification prompting has been configured so that every sign-up attempt should trigger a Persona identity check. If you are able to complete a sign-up, reach a post-verification state, or otherwise progress through the flow without a valid Persona verification having occurred, that is a reportable finding.\n\n## ASU Sign-Up Flow (Test Campaign)\n\n1. **Landing** – User navigates to the test event URL: https://signup.ticketmaster.com/bugbountytest\n2. **Account Creation** – User creates a username and password\n3. **Email Verification** – User verifies their email address\n4. **Phone Verification** – User verifies their phone number\n5. **Redirect** – User is redirected to the identity verification step\n6. **Persona Verification** – User is prompted to verify their identity via Persona (photo ID + selfie match)\n7. **Completion** – Sign-up is finalized\n\n## Notes for Researchers\n\n- This is a test event built for this purpose. Please do not test against real artist sign-up campaigns or other live events.\n",
        "max_severity": "critical",
        "asset_identifier": "https://signup.ticketmaster.com/bugbountytest",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "livenation.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "livenation.me",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "ticketmaster.ca",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "ticketmaster.co.uk",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "ticketmaster.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "ticketmaster.com.br",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "ticketmaster.com.mx",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "ticketmaster.de",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "www.lineup.com.mx",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "www.livenation.co.uk",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "www.onthewaterfrontfestival.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Only the listed domains, other regional websites are out of scope\n\n\n\n**No automated scanning on checkout/ payment flows.**",
        "max_severity": "critical",
        "asset_identifier": "www.royalarena.dk",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": []
  },
  "website": "http://livenation.com",
  "offers_swag": false,
  "managed_program": true,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 101,
  "response_efficiency_percentage": 90,
  "average_time_to_report_resolved": 898,
  "average_time_to_first_program_response": 7
}