Featured on
Featured on
— no diffs detected in snapshot history yet —
No reports yet — be the first to share your triage timing for Superbet.
// peer-sourced response times. platforms won’t publish this — hunters can. anonymized in aggregate.
{
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 110,
"average_time_to_first_program_response": 13,
"average_time_to_report_resolved": null,
"handle": "superbet",
"id": 0,
"managed_program": true,
"name": "Superbet",
"offers_bounties": true,
"offers_swag": false,
"response_efficiency_percentage": 95,
"submission_state": "open",
"url": "https://hackerone.com/superbet",
"website": "https://superbet.ro",
"targets": {
"in_scope": [
{
"asset_identifier": "*.happening.dev",
"asset_type": "WILDCARD",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "*.luckydays.ca",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.luckydays.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.napoleoncasino.be",
"asset_type": "WILDCARD",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "*.napoleondice.be",
"asset_type": "WILDCARD",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "*.napoleongames.be",
"asset_type": "WILDCARD",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "*.napoleonsports.be",
"asset_type": "WILDCARD",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "You need a real/fake Belgium ID to register an account on the main casino/sport app.\nYou can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "not_defined",
"max_severity": "critical"
},
{
"asset_identifier": "*.spinaway.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com. ",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.super.xyz",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": null,
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.superbet.com",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.superbet.gr",
"asset_type": "WILDCARD",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Websites only available from Greece use VPN\nTest Accounts: \n26hackeronegreece01 - qPW2R%jnniYn4hrP\n 26hackeronegreece02 - jjqAW@l34KsXbXJJ \n26hackeronegreece03 - 8tjK%tv&Pp%pUbcM \n26hackeronegreece04 - 2aZxrZ@r8enzkp%f\n 26hackeronegreece05 - gYaUJdkDgc3@5x34",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "*.superbet.pl",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only from Poland use VPN\n Test Accounts: \n26hackeronepoland02 - ZIzUxh@D1FWrb@yF \n26hackeronepoland03 - 6J@K%IU9fVbMhCe9 \n26hackeronepoland04 - a%TlmhYhTxaMA%@8 \n26hackeronepoland05 - hCR63P@vPWGj&Rws\n26hackeronepoland06 - rI%nUj6E%cU5Lpkd",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.superbet.ro",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are using a Romanian VPN as the portal works only for Romanian IP’s.\nOr use a test account from this list:\n26hackeroneromania02 - IrKFiZ5fm#h2r0a6\n26hackeroneromania03 - RF0nMx%fQiSUtZu@\n26hackeroneromania04 - w#!G4%&AppmVs9s1\n26hackeroneromania05 - NKpFn06Y#Wl1eojv\n26hackeroneromania06 - f5M73r4XLRdQU@Hq\n● Please add the following User-Agent header when you are using any automated tools or scripts - User-agent: hackerone -. Requests that will not contain this cookie header might get blocked by our tools/SOC team.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "*.superbet.rs",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "This is our new betting platform, available only in serbia. We only allow connection from Serbian Ip's, so please use a VPN.\nTest Accounts:\n26hackeroneserbia06 - YAJ6chCI9ra3fX%s\n26hackeroneserbia07 - 3hoPBI2sQRuIxDJ#\n26hackeroneserbia08 - Wqs!C7b8LLURfgbH\n26hackeroneserbia09 - @p0fNOlvVJLwZobb\n26hackeroneserbia10 - a1LWLzyAIns@HWY5",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "WGP Slot Games",
"asset_type": "OTHER",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "All games from WGP provider are in scope for testing. \nYou can find them by filtering for WGP provider on Napoleon platform. Make sure you use VPN for BE.\nhttps://napoleoncasino.be/en-be/games/search?query=wgp",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "https://napoleoncasino.be",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only from Belgium\nYou need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "https://napoleoncasino.be/en-be/game/hogamba-crash?demo=false",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "slot game available on be/ro platforms and on BR in the future.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "https://napoleoncasino.be/nl-be/game/plinko-napoleon?demo=false",
"asset_type": "OTHER",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "https://napoleondice.be",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only from Belgium.\nYou need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "https://napoleongames.be",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only from Belgium\nYou need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "https://napoleonsports.be",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only from Belgium. You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "https://super.xyz",
"asset_type": "URL",
"availability_requirement": "low",
"confidentiality_requirement": "low",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "low impact asset (3rd party managed service) with no sensitive data/functionality on it.",
"integrity_requirement": "low",
"max_severity": "low"
},
{
"asset_identifier": "https://superbet.pl",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only from Poland use VPN\nTest Accounts:\n26hackeronepoland02 - ZIzUxh@D1FWrb@yF\n26hackeronepoland03 - 6J@K%IU9fVbMhCe9\n26hackeronepoland04 - a%TlmhYhTxaMA%@8\n26hackeronepoland05 - hCR63P@vPWGj&Rws\n26hackeronepoland06 - rI%nUj6E%cU5Lpkd",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "https://superbet.ro",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are using a Romanian VPN as the portal works only for Romanian IP’s.\nOr use a test account from this list:\n26hackeroneromania02 - IrKFiZ5fm#h2r0a6\n26hackeroneromania03 - RF0nMx%fQiSUtZu@\n26hackeroneromania04 - w#!G4%&AppmVs9s1\n26hackeroneromania05 - NKpFn06Y#Wl1eojv\n26hackeroneromania06 - f5M73r4XLRdQU@Hq\n● Please add the following User-Agent header when you are using any automated tools or scripts - User-agent: hackerone -. Requests that will not contain this cookie header might get blocked by our tools/SOC team.",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "https://superbet.rs",
"asset_type": "URL",
"availability_requirement": "high",
"confidentiality_requirement": "high",
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only from Serbia use VPN\nTest Account:\n26hackeroneserbia06 - YAJ6chCI9ra3fX%s\n26hackeroneserbia07 - 3hoPBI2sQRuIxDJ#\n26hackeroneserbia08 - Wqs!C7b8LLURfgbH\n26hackeroneserbia09 - @p0fNOlvVJLwZobb\n26hackeroneserbia10 - a1LWLzyAIns@HWY5",
"integrity_requirement": "high",
"max_severity": "critical"
},
{
"asset_identifier": "ro.superbet.games",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Make sure you change your google play country to Romania so you can access the app.\nhttps://play.google.com/store/apps/details?id=ro.superbet.games&hl=ro&gl=RO",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "ro.superbet.sport",
"asset_type": "GOOGLE_PLAY_APP_ID",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Make sure you set the location to your google play account to Romania so you can access the app\nhttps://play.google.com/store/apps/details?id=ro.superbet.sport&hl=ro&gl=RO",
"integrity_requirement": null,
"max_severity": "critical"
},
{
"asset_identifier": "superbet.bet.br",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": true,
"eligible_for_submission": true,
"instruction": "Website available only for Brazil use VPN.\nTest Accounts:\n26hackeronebrazil02 - NyX#xTsIz8@8mku0\n26hackeronebrazil03 - LQg@9wyRk#7Xj!wX\n26hackeronebrazil04 - 1p99kdS1PeD&PZaf\n26hackeronebrazil05 - 4lz@ZvKqIp5z!vl7\n26hackeronebrazil06 - r0G#ViDGd!epgr4&",
"integrity_requirement": null,
"max_severity": "critical"
}
],
"out_of_scope": [
{
"asset_identifier": "*.epic.superbet.ro",
"asset_type": "WILDCARD",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "affiliate.napoleongames.be",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "3rd party",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "affiliates.superbet.com",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "none",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": "none",
"max_severity": "none"
},
{
"asset_identifier": "affiliates.superbet.rs",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "none",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": "none",
"max_severity": "none"
},
{
"asset_identifier": "http://abc.superbet.rs",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "3rd party",
"integrity_requirement": "not_defined",
"max_severity": "none"
},
{
"asset_identifier": "http://surveys.superbet.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": "not_defined",
"max_severity": "none"
},
{
"asset_identifier": "https://afiliados.superbet.com",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "3rd party, out of scope",
"integrity_requirement": "not_defined",
"max_severity": "none"
},
{
"asset_identifier": "https://legacy-web.superbet.ro/session/login",
"asset_type": "URL",
"availability_requirement": null,
"confidentiality_requirement": null,
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "All our LOGIN services are out of scope for the moment.\nAny bruteforce attempt on our login services will be considered misbehavior and you will be banned from the program. We won't reward any credentials identified using bruteforce attacks.\nThank you!",
"integrity_requirement": null,
"max_severity": "none"
},
{
"asset_identifier": "https://retail.prod.incubator.superbet.ro/ssbt-api/",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "out of scope",
"integrity_requirement": "not_defined",
"max_severity": "none"
},
{
"asset_identifier": "lp.superbet.bet.br",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "none",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "none",
"max_severity": "none"
},
{
"asset_identifier": "lp.superbet.com",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "none",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "none",
"max_severity": "none"
},
{
"asset_identifier": "lp.superbet.pl",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "none",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "none",
"max_severity": "none"
},
{
"asset_identifier": "lp.superbet.ro",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "none",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "none",
"max_severity": "none"
},
{
"asset_identifier": "lp.superbet.rs",
"asset_type": "URL",
"availability_requirement": "none",
"confidentiality_requirement": "none",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "none",
"max_severity": "none"
},
{
"asset_identifier": "test-gw.epic.superbet.ro",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": null,
"integrity_requirement": "not_defined",
"max_severity": "none"
},
{
"asset_identifier": "test.epic.superbet.ro",
"asset_type": "URL",
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined",
"eligible_for_bounty": false,
"eligible_for_submission": false,
"instruction": "",
"integrity_requirement": "not_defined",
"max_severity": "none"
}
]
}
}*.luckydays.com· critical