Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for Hilton.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 11,
"average_time_to_first_program_response": 2,
"average_time_to_report_resolved": null,
"handle": "hilton",
"id": 0,
"managed_program": true,
"name": "Hilton",
"offers_bounties": true,
"offers_swag": true,
"response_efficiency_percentage": 84,
"submission_state": "open",
"url": "https://hackerone.com/hilton",
"website": "http://hilton.com",
"targets": {
"in_scope": [
{
"asset_identifier": "*.hilton.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "All subdomains of hilton.com that resolve to IP addresses belonging to the Rackspace organization are considered out of scope. In addition, the application eis.hilton.com is out of scope.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.hilton.io",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.hiltonbusinessonline.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.hiltonlocalbiz.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "121.200.237.36/29",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "167.187.0.0/16",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "192.251.123.0/24",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "192.251.124.0/24",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "192.251.125.0/24",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "192.251.126.0/24",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "203.79.37.2/29",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "62.216.152.46/29",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "82.196.42.196/28",
"asset_type": "CIDR",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "Hilton Franchised Properties",
"asset_type": "OTHER",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "Hilton Third Party Applications - *.hilton.com",
"asset_type": "OTHER",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "These are applications that are hosted by a 3rd party, but are accessible using a sub-domain of hilton.com (i.e. *.hilton.com).",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "Managed Property Assets",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "com.hilton.android.hhonors",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Authentication functionality when a user creates a Hilton Honors account (https://www.hilton.com/en/hilton-honors/join/). To create a Hilton Honors account, finders should complete the free sign-up process. The string “Test-Hackerone” must be prepended to the First and Last name fields for all Honors accounts created for the purposes of security testing. ",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "hilton.io",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "hiltonbusinessonline.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "hiltonlocalbiz.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "id635150066",
"asset_type": "APPLE_STORE_APP_ID",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "resmax.hilton.com",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "high",
"max_severity": "critical"
}
],
"out_of_scope": [
{
"asset_identifier": "*.hamptonhotels.com.cn",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "*.hiltonhotels.jp",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "a1.hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "eis.hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "guestfeedback.hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "This asset is hosted by Qualtrics, and as such these reports should be submitted directly to them.",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "hgv.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®, and as such these reports should be submitted to them directly.",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "hiltonfoundation.org",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "hiltongrandvacations.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®, and as such these reports should be submitted to them directly.",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "hiltonnet.hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "https://jobs.hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "onqinsider.hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "pim.hilton.com",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": null,
"max_severity": "none"
}
]
}
}*.hiltonbusinessonline.com· criticalid635150066· critical121.200.237.36/29· critical167.187.0.0/16· critical192.251.123.0/24· critical192.251.124.0/24· critical192.251.125.0/24· critical192.251.126.0/24· critical203.79.37.2/29· critical62.216.152.46/29· critical82.196.42.196/28· criticalHilton Franchised Properties· criticalHilton Third Party Applications - *.hilton.com· criticalManaged Property Assets· criticalcom.hilton.android.hhonors· critical