[WhiteJar] Bug Bounty Program Launch Wizard

Using this wizard, you will start a new Bug Bounty program.

Once filled out, the platform will activate Ethical Hackers and they will start to search for vulnerabilities according to the specifications defined through the wizard.

The output will be visible in real-time on the Kanban Board, where you can manage vulnerabilities with the various tools available.

If the product is already accessible, it usually takes 24h to start the campaign.
Team that will benefit from the Bug Bounty program
ex: Acme spa/Team Mobile Android
Name and Surname
Person that launch the program
Email
Person that launch the program

Goal of the program/In Scope/Out of Scope

In this section you can specify the goal of the Bug Bounty program and you have space to tell what kind of vulnerabilities you expect to identify
Goal of the test
Example: Test will be carried out exclusively on mobile apps available on official stores (production environment) for devices with Android operating system and IOS, downloadable from addresses defined by endpoints.Enter everything that comes to your mind that can help us understand the program and model of engagement you intend to have with the Ethical Hacker community
Program Type
For a public program, the entire registered community will have visibility of the program. For a private program, only a pre-selected group will have visibility.
Verified Ethical Hackers Selection
What is In Scope fo this program
Example In scope: Vulnerabilities and tests on endpoints, both about the web frontend and about the servers and services installed on it, while respecting the out of scope cases.
List what can be considered Out Of Scope for testing?
Example:
Everything outside the defined scope is considered out of scope. This includes:

Any physical attacks against program owner's property or data centers
Scanner output or scanner-generated reports, including any automated or active exploit tool
Man-in-the-Middle attacks
Social engineering attacks, including those targeting or impersonating internal employees by any means (e.g. customer service chat features, social media, personal domains, etc.)
Host header injections without a specific, demonstrable impact
Vulnerabilities found through DDoS or spam attacks. If you discover a vulnerability and believe it can cause DoS (for example, a logical flaw or known CVE), please submit it and we will review on a case-by-case basis. Do not attempt or execute DDoS attacks.
Self-XSS, which includes any payload entered by the victim
Any vulnerabilities requiring significant and unlikely interaction by the victim, such as disabling browser controls
Login/logout CSRF
Content spoofing without embedding an external link or JavaScript
Infrastructure vulnerabilities, including:
Issues related to SSL certificates
DNS configuration issues
Server configuration issues (e.g. open ports, TLS versions, etc.)
Vulnerabilities only affecting users of outdated, unpatched, or unsupported browsers and platforms, including any version of Internet Explorer
Any XSS that requires Flash. Flash is disabled by default in most modern browsers, thus greatly reducing the attack surface and associated risk.
Any other submission determined to be low risk, based on unlikely or theoretical attack vectors, requiring significant user interaction, or resulting in minimal impact

It is also forbidden to upload files in large quantities or sizes with the intent of depleting resources in the (potential) sections of the sites where uploads are allowed. To produce Proof of Concepts (PoC), it is sufficient to demonstrate a policy violation without causing excessive resource usage.
Additional specifications to share (Known vulnerabilities)

Upload any document you find useful to run the test and list known bugs. For example, a Powerpoint presentation that defines the app scope, technical details and so on. If you don’t have any, leave the form empty.
Cancelof
Subject of test/Testing Endpoints

In this section you can specify what you want to test (a mobile app, a website, etc.) and specify how we can reach endpoints (for example if password access is required).
What do you want to test?
Enter endpoints to test
Enter all links to test separated by ","
Test Environment
Are there any restrictions we should consider and/or credentials to access the endpoints to be tested?
If yes, specify which:
Also describe how we can obtain accounts to access test areas (if any)
Additional notes:
Enter all the useful notes to understand how to better reach the test areas and how the Ethical Hacker can organize to manage their work
Bug Bounty plan

Choose test plan details like start date and timing. The campaign will remain open until the end of the bounty budget or under direct indication from your team.
Start date of the program

DayMonthYear
Duration of the program
Enter the test period to which you want to submit endpoints
Notes on timing
All that allows us to understand how to manage the project at the level of timing

Should be Empty:

Goal of the program/In Scope/Out of Scope

Subject of test/Testing Endpoints

Bug Bounty plan