ForeScout Technologies Bug Bounty Program

Program Overview

ForeScout Technologies runs a bug bounty program on HackerOne. The program has 63 in-scope assets and is managed by HackerOne's triage team.

In-Scope Assets

Asset	Type	Max Severity	Eligible
194.90.151.192/28	CIDR	Critical	Bounty
194.90.25.80/29	CIDR	Critical	Bounty
194.90.89.165/32	CIDR	Critical	Bounty
212.143.112.81/29	CIDR	Critical	Bounty
38.140.238.56/29	CIDR	Critical	Bounty
64.47.18.80/29	CIDR	Critical	Bounty
64.84.60.0/24	CIDR	Critical	Bounty
97.105.243.96/28	CIDR	Critical	Bounty
CounterAct 9.x	HARDWARE	High	Bounty
ab2b0c50cdc7b445391f99d4957850c5-cd4ccfdb37dfafad.elb.us-east-1.amazonaws.com	URL	Critical	Bounty
aebddc74953f248bc8455665b0f7d47b-78af959a11e5d0c1.elb.us-east-1.amazonaws.com	URL	Critical	Bounty
cloud.forescout.com	URL	Critical	Bounty
community.forescout.com	URL	Critical	Bounty
datapod-1-100-druid-ingest.development.forescoutcloud.net	URL	Critical	Bounty
datapod-1-100-druid-ingest.testing.forescoutcloud.net	URL	Critical	Bounty
datapod-1-100-druid-query.development.forescoutcloud.net	URL	Critical	Bounty
datapod-1-100-druid-query.production.forescoutcloud.net	URL	Critical	Bounty
datapod-1-druid-ingest.production.forescoutcloud.net	URL	Critical	Bounty
datapod-1-ingest.production.forescoutcloud.net	URL	Critical	Bounty
datapod-1-query.production.forescoutcloud.net	URL	Critical	Bounty
datapod-2-druid-ingest.production.forescoutcloud.net	URL	Critical	Bounty
datapod-2-ingest.acceptance.forescoutcloud.net	URL	Critical	Bounty
datapod-2-query.acceptance.forescoutcloud.net	URL	Critical	Bounty
de.forescout.cloud	URL	Critical	Bounty
http://backend-api.devicecloud.production.forescoutcloud.net/api/v1/settings	URL	Critical	Bounty
http://datapod-1-druid-ingest.production.forescoutcloud.net/v1/upload	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v1/polling	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v1/query/agg	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/deletestatus	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/matrixoverview	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/firstreporttimeentry	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/grouptogroup	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/iplist	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/ips/bydst/details	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/ips/bysrc	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/query/overlappinggroups	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/service-list	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v2/services	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v3/matrixoverview	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v3/query/overlappingzones	URL	Critical	Bounty
http://datapod-1-druid-query.production.forescoutcloud.net/v3/query/zonetozone	URL	Critical	Bounty
http://logstash-props.devicecloud.production.forescoutcloud.net/api/v1/properties	URL	Critical	Bounty
http://mgmtpod-1.production.forescoutcloud.net/oauth/token	URL	Critical	Bounty
https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/package	URL	Critical	Bounty
https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/polling	URL	Critical	Bounty
https://telemetry-polling.devicecloud.acceptance.forescoutcloud.net/v1/upload	URL	Critical	Bounty
iris-testing-us-east-1-nlb-4df4bbde6f6e2bbb.elb.us-east-1.amazonaws.com	URL	Critical	Bounty
logstash-props.devicecloud.acceptance.forescoutcloud.net	URL	Critical	Bounty
mgmt-sensors.iris.acceptance.forescoutcloud.net	URL	Critical	Bounty
mgmt-sensors.iris.production.forescoutcloud.net	URL	Critical	Bounty

Showing 50 of 63 in-scope assets. View all on HackerOne.

Out-of-Scope Assets

• datapod-1-100-ingest.development.forescoutcloud.net
• datapod-1-100-ingest.testing.forescoutcloud.net
• datapod-1-100-query.development.forescoutcloud.net
• datapod-1-100-query.testing.forescoutcloud.net
• datapod-1-ingest.acceptance.forescoutcloud.net
• datapod-1-query.acceptance.forescoutcloud.net
• mgmtpod-1-100-dashboard.development.forescoutcloud.net
• mgmtpod-1-100.development.forescoutcloud.net

Tips for Hacking ForeScout Technologies

1. Read the policy — Understand what's in scope, out of scope, and any specific testing restrictions before you start.
2. Enumerate the attack surface — Use subdomain enumeration and directory bruteforcing to map all accessible endpoints.
3. Focus on high-impact bugs — Look for SQL injection, SSRF, and IDOR vulnerabilities first.
4. Test authentication flows — Check for OAuth misconfigurations and CSRF in login/signup flows.
5. Write clear reports — Include steps to reproduce, impact assessment, and suggested remediation. Use Burp Suite to capture evidence.

Frequently Asked Questions

How do I start hacking ForeScout Technologies?

Sign up on HackerOne, read the program policy carefully, review the in-scope assets listed above, and start testing. Always stay within scope and follow responsible disclosure guidelines.

Does ForeScout Technologies pay bounties?

Yes, ForeScout Technologies offers monetary rewards for valid security vulnerabilities.

What types of vulnerabilities does ForeScout Technologies accept?

ForeScout Technologies accepts reports for vulnerabilities found in their 63 in-scope assets. Common accepted vulnerability types include XSS, SQL injection, SSRF, IDOR, authentication bypass, and RCE. Check the program policy for specific exclusions.