InnoGames

target_in_scope

asset_identifier asset_type availability requirement confidentiality requirement eligible for bounty eligible for submission integrity requirement max_severity
*.igpayment.com URL critical
This is our payment environment used in all of our games. Steps to test: * Register an account in one of our web-based browser games (the test markets cannot be used for this) * When in the game launch the payment process by clicking the "+" symbol next to your diamond count * You're now in the payment process where you can select different diamond packages * Find the iframe referencing www.igpayment.com within the page source * The iframe URL looks like this: ``` https://www.igpayment.com/api/providers/creditcard-wpg/purchase/{sessionId} ``` * You can also use the voucher system to execute requests. * Happy Fuzzing
*.innogames.com URL critical
On *.innogames.com all customer facing services can be found. **Notes for www.innogames.com** This is our company homepage using typo3 * If you find bugs in Typo3 please report them directly, these are not covered by this program, unless a new Typo Version has been released for more than 30 days * The settings, custom built extensions and integrations are covered under this program * Vulnerability resulting from outdated versions are covered under this program **Please DO NOT test the contact form at https://www.innogames.com/company/contact/** **Notes for support.innogames.com** * Please avoid creating many new tickets, but instead concentrate your testing on the ticket contents.
*.innogames.de URL critical
On *.innogames.de Corporate and Community Tools can be found. **Notes for login.innogames.de** This is our central login and account management tool * We do not provide accounts for this service and there are no registration pages available. * That said, feel free to try and break it from a blackbox perspective. - **Brute-force testing is not allowed on login.innogames.de**
air.com.innogames.grepolis.com OTHER_APK critical
Sign up on HockeyApp and download the special app for BugBounty testing: https://rink.hockeyapp.net/recruit/0c3e99df06b24a919b8ec8de1b0c4843
com.innogames.enterprise.elvenar OTHER_APK critical
Sign up on HockeyApp and download the special app for BugBounty testing: https://rink.hockeyapp.net/recruit/0c3e99df06b24a919b8ec8de1b0c4843
com.innogames.enterprise.elvenar OTHER_IPA critical
Sign up on HockeyApp and download the special app for BugBounty testing: https://rink.hockeyapp.net/recruit/0c3e99df06b24a919b8ec8de1b0c4843
com.innogames.enterprise.grepolis.com OTHER_IPA critical
Sign up on HockeyApp and download the special app for BugBounty testing: https://rink.hockeyapp.net/recruit/0c3e99df06b24a919b8ec8de1b0c4843
com.innogames.enterprise.iforge OTHER_IPA critical
Sign up on HockeyApp and download the special app for BugBounty testing: https://rink.hockeyapp.net/recruit/0c3e99df06b24a919b8ec8de1b0c4843
com.innogames.foeandroid OTHER_APK critical
Sign up on HockeyApp and download the special app for BugBounty testing: https://rink.hockeyapp.net/recruit/0c3e99df06b24a919b8ec8de1b0c4843
tribalwars.cash URL critical
This is our game master server which stores information about all worlds available - in this case only "World 1" - xs1. **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs.elvenar.com URL critical
This is our game landing page system which is used to signup, login and get news about the game **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs.forgeofempires.com URL critical
This is our game landing page system which is used to signup, login and get news about the game **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs.grepolis.com URL critical
This is our game landing page system which is used to signup, login and get news about the game **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs0.elvenar.com URL critical
This is our game master server which stores information about all worlds available - in this case only xs1 **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs0.forgeofempires.com URL critical
This is our game master server which stores information about all worlds available - in this case only xs1 **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs0.grepolis.com URL critical
This is our game master server which stores information about all worlds available - in this case only xs1 **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs1.elvenar.com URL critical
This is the actual game world where all the game logic resides and the player gets redirected to **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players Note on Flash/HTML5 Versions We do currently run two versions of the game: one is Flash-based and deprecated and one is based on HTML5. We have enforced the HTML5 version on the in-scope assets and only accept vulnerabilities affecting the HTML5 version. (which is to say the flash version is out-of-scope)
xs1.forgeofempires.com URL critical
This is the actual game world where all the game logic resides and the player gets redirected to **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs1.grepolis.com URL critical
This is the actual game world where all the game logic resides and the player gets redirected to **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players
xs1.tribalwars.cash URL critical
This is the actual game world where all the game logic resides and the player gets redirected to **Dedicated testing system** * Request limit does not apply * The game worlds will be reset and updated regularly without any advance notice * All users on these systems are testers so you will not impact any players

target_out_of_scope

asset_identifier asset_type availability requirement confidentiality requirement eligible for bounty eligible for submission integrity requirement max_severity