Program Overview
DIB-VDP runs a vulnerability disclosure program on HackerOne. The program has 1029 in-scope assets.
1029
In-Scope Assets
13h
Avg Response
100%
Efficiency
240d
Avg Resolve
In-Scope Assets
| Asset | Type | Max Severity | Eligible |
|---|---|---|---|
| 38.142.101.156 | IP_ADDRESS | Critical | No Bounty |
| *.2asc.com | WILDCARD | Critical | No Bounty |
| *.alex-as.com | WILDCARD | Critical | No Bounty |
| *.alexamerican.com | WILDCARD | Critical | No Bounty |
| *.americansystems.com | WILDCARD | Critical | No Bounty |
| *.ascgov.com | WILDCARD | Critical | No Bounty |
| *.ascsites.com | WILDCARD | Critical | No Bounty |
| *.autodiscover.americansystems.com | WILDCARD | Critical | No Bounty |
| *.coalfirefederal.com | WILDCARD | Critical | No Bounty |
| *.ddlomni.com | WILDCARD | Critical | No Bounty |
| *.dese.com | WILDCARD | Critical | No Bounty |
| *.emsolve.com | WILDCARD | Critical | No Bounty |
| *.epsilon-inc.com | WILDCARD | Critical | No Bounty |
| *.epsilon-inc.dev | WILDCARD | Critical | No Bounty |
| *.hxfivelaunch.com | WILDCARD | Critical | No Bounty |
| *.nhaero.com | WILDCARD | Critical | No Bounty |
| *.savecloud.biz | WILDCARD | Critical | No Bounty |
| *.savedev.biz | WILDCARD | Critical | No Bounty |
| 100.36.51.5 | IP_ADDRESS | Critical | No Bounty |
| 104.249.144.8 | IP_ADDRESS | Critical | No Bounty |
| 104.249.145.8 | IP_ADDRESS | Critical | No Bounty |
| 12.125.144.150 | IP_ADDRESS | Critical | No Bounty |
| 12.215.182.100 | IP_ADDRESS | Critical | No Bounty |
| 12.96.87.210 | IP_ADDRESS | Critical | No Bounty |
| 12.96.87.214 | IP_ADDRESS | Critical | No Bounty |
| 12.96.87.216 | IP_ADDRESS | Critical | No Bounty |
| 12.96.87.219 | IP_ADDRESS | Critical | No Bounty |
| 129.222.249.89 | IP_ADDRESS | Critical | No Bounty |
| 129.222.81.69 | IP_ADDRESS | Critical | No Bounty |
| 13.64.181.40 | IP_ADDRESS | Critical | No Bounty |
| 13.91.223.119 | IP_ADDRESS | Critical | No Bounty |
| 132.228.146.2/32 | CIDR | Critical | No Bounty |
| 132.228.191.97/32 | CIDR | Critical | No Bounty |
| 132.228.24.17/32 | CIDR | Critical | No Bounty |
| 132.228.45.35/32 | CIDR | Critical | No Bounty |
| 134.223.117.169/32 | CIDR | Critical | No Bounty |
| 134.223.117.170/32 | CIDR | Critical | No Bounty |
| 134.223.117.197/32 | CIDR | Critical | No Bounty |
| 134.223.117.198/32 | CIDR | Critical | No Bounty |
| 134.223.120.148/32 | CIDR | Critical | No Bounty |
| 134.223.120.152/32 | CIDR | Critical | No Bounty |
| 134.223.120.154/32 | CIDR | Critical | No Bounty |
| 134.223.120.166/32 | CIDR | Critical | No Bounty |
| 134.223.120.167/32 | CIDR | Critical | No Bounty |
| 134.223.120.169/32 | CIDR | Critical | No Bounty |
| 134.223.120.180/32 | CIDR | Critical | No Bounty |
| 134.223.120.183/32 | CIDR | Critical | No Bounty |
| 134.223.120.184/32 | CIDR | Critical | No Bounty |
| 134.223.120.186/32 | CIDR | Critical | No Bounty |
| 134.223.120.33/32 | CIDR | Critical | No Bounty |
Showing 50 of 1029 in-scope assets. View all on HackerOne.
Out-of-Scope Assets
- http://adpass.bisimulations.com
- http://bluechannel.bisimulations.com
- http://cdc.bisimulations.com
- http://cdc.devops.bisimulations.com
- http://cdc.staging.bisimulations.com
- http://cdc.staging.devops.bisimulations.com
- http://cdcdevops.bisimulations.com
- http://content.bisimulations.com
- http://distribution-origin.bisimulations.com
- http://dmz-cdnorigin1.bisimulations.com
- http://ftp-au.bisimulations.com
- http://ftp-orl.bisimulations.com
- http://ftp-stage.terrasim.com
- http://ftp.terrasim.com
- http://kb.bisimulations.com
- http://licensing.bisimulations.com
- http://lm.bisimulations.com
- http://manuals.bisimulations.com
- http://marketplace.bisimulations.com
- http://news.bisimulations.com
Tips for Hacking DIB-VDP
- Read the policy — Understand what's in scope, out of scope, and any specific testing restrictions before you start.
- Enumerate the attack surface — Use subdomain enumeration and directory bruteforcing to map all accessible endpoints.
- Focus on high-impact bugs — Look for SQL injection, SSRF, and IDOR vulnerabilities first.
- Test authentication flows — Check for OAuth misconfigurations and CSRF in login/signup flows.
- Write clear reports — Include steps to reproduce, impact assessment, and suggested remediation. Use Burp Suite to capture evidence.
Frequently Asked Questions
How do I start hacking DIB-VDP?
Sign up on HackerOne, read the program policy carefully, review the in-scope assets listed above, and start testing. Always stay within scope and follow responsible disclosure guidelines.
Does DIB-VDP pay bounties?
No, DIB-VDP runs a Vulnerability Disclosure Program (VDP) without monetary rewards. You may receive recognition or swag.
What types of vulnerabilities does DIB-VDP accept?
DIB-VDP accepts reports for vulnerabilities found in their 1029 in-scope assets. Common accepted vulnerability types include XSS, SQL injection, SSRF, IDOR, authentication bypass, and RCE. Check the program policy for specific exclusions.