Bug Bounties

Citrix Systems

Powered by: 

Allows bounty splitting: 

Average time to first program response: 8

Average time to bounty awarded null: 294

Average time to report resolved: 625

Handle citrix

Managed program: true

Name: Citrix Systems

Offers bounties: true

Offers swag: false

Response efficiency percentage: 92

Submission state: open

Url: https://hackerone.com/citrix

Website: http://citrix.com

In scope:

  • Asset identifier: (youriwssubdomain).cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please visit the following URL and chose the "Get your test instance" option to get a test environment: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform/build/docs/developer-test-instance. **Note:** You would need to link your existing Citrix Cloud account or create a new one to get a test environment. Learn more about the product through guides and videos available here: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform. The documentation regarding Citrix IWS is available here: https://docs.citrix.com/en-us/citrix-microapps.html We have created a small video walkthrough of the product using a sample microapp to ensure that you can get to hacking the application as soon as possible. You can view the video and download the sample microapp using the following links: - Link to video walkthrough: https://citrix.sharefile.com/d-scee2fe1523bf40f68188d984abf871a2 - Link to the sample microapp: https://citrix.sharefile.com/d-s221da461659f42c697e0d327ff88e54e
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: (yoursubdomain).ap.iws.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please visit the following URL and chose the "Get your test instance" option to get a test environment: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform/build/docs/developer-test-instance. **Note:** You would need to link your existing Citrix Cloud account or create a new one to get a test environment. Learn more about the product through guides and videos available here: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform. The documentation regarding Citrix IWS is available here: https://docs.citrix.com/en-us/citrix-microapps.html We have created a small video walkthrough of the product using a sample microapp to ensure that you can get to hacking the application as soon as possible. You can view the video and download the sample microapp using the following links: - Link to video walkthrough: https://citrix.sharefile.com/d-scee2fe1523bf40f68188d984abf871a2 - Link to the sample microapp: https://citrix.sharefile.com/d-s221da461659f42c697e0d327ff88e54e
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: (yoursubdomain).eu.iws.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please visit the following URL and chose the "Get your test instance" option to get a test environment: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform/build/docs/developer-test-instance. **Note:** You would need to link your existing Citrix Cloud account or create a new one to get a test environment. Learn more about the product through guides and videos available here: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform. The documentation regarding Citrix IWS is available here: https://docs.citrix.com/en-us/citrix-microapps.html We have created a small video walkthrough of the product using a sample microapp to ensure that you can get to hacking the application as soon as possible. You can view the video and download the sample microapp using the following links: - Link to video walkthrough: https://citrix.sharefile.com/d-scee2fe1523bf40f68188d984abf871a2 - Link to the sample microapp: https://citrix.sharefile.com/d-s221da461659f42c697e0d327ff88e54e
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: (yoursubdomain).sf-api.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please only test on the subdomain you have created for your test instance.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: (yoursubdomain).sf-api.eu
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please only test with the subdomain created for your test instance.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: (yoursubdomain).sharefile.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please only test with the subdomain created for your test instance.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: (yoursubdomain).sharefile.eu
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please only test with the subdomain created for your test instance.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: (yoursubdomain).us.iws.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please visit the following URL and chose the "Get your test instance" option to get a test environment: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform/build/docs/developer-test-instance. **Note:** You would need to link your existing Citrix Cloud account or create a new one to get a test environment. Learn more about the product through guides and videos available here: https://developer.cloud.com/citrixworkspace/citrix-workspace-platform. The documentation regarding Citrix IWS is available here: https://docs.citrix.com/en-us/citrix-microapps.html We have created a small video walkthrough of the product using a sample microapp to ensure that you can get to hacking the application as soon as possible. You can view the video and download the sample microapp using the following links: - Link to video walkthrough: https://citrix.sharefile.com/d-scee2fe1523bf40f68188d984abf871a2 - Link to the sample microapp: https://citrix.sharefile.com/d-s221da461659f42c697e0d327ff88e54e
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: *.browser.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: *.citrixworkspacesapi.net
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: *developer.cloud.com
  • Asset type: URL
  • Availability requirement: none
  • Confidentiality requirement: none
  • Eligible for bounty: 
  • Eligible for submissions: true
  • Instruction: This asset is will NOT be eligible for the bounty as this domain is intended for documentation only. Kindly avoid attacking the documentation site.
  • Integrity requirements: none
  • Max severity: none



  • Asset identifier: accounts-internal.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: accounts.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: adm.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: Please note that some UI elements and features of ADM may only become available when an organization has an ADC, MPX, SDX or VPX appliance to onboard into ADM. The most efficient and cost-effective way to do this would be setting up a "Citrix ADC VPX Express – 20 Mbps" from the AWS or Microsoft Azure marketplace which typically has an hourly running cost of 2-3 cents. - https://aws.amazon.com/marketplace/pp/B0796LD46X - https://azuremarketplace.microsoft.com/en-us/marketplace/apps/citrix.netscalervpx-130 Overview - https://docs.citrix.com/en-us/citrix-application-delivery-management-service/overview.html. Onboarding instructions - https://docs.citrix.com/en-us/citrix-application-delivery-management-service/getting-started.html
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: ap-s.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: api.adm.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: This is the API Gateway for Citrix Application Delivery Management. All traffic between an Agent and Application Delivery Management service is proxied via API Gateway. API Gateway is also responsible for API authorization checks for traffic from the Agent to Application Delivery Management.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: api.sharefile.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: api.sharefile.eu
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: citrix.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: eu.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: http://(yoursubdomain).sharefile.com/sf/v3/
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: You can review our list of updated APIs at api.sharefile.com
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: launch.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: onboarding-*.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: onboarding.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: secure.sharefile.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: secure.sharefile.eu
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: sf-rp-eu.sharefile.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: This is the domain you land on when reaching the Content Collaboration app from Citrix Cloud.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: sf-rp-us.sharefile.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: This is the domain you land on when reaching the Content Collaboration app from Citrix Cloud.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: sf-rp.sharefile.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: This is the domain you land on when reaching the Content Collaboration app from Citrix Cloud.
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: us.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical



  • Asset identifier: www.cloud.com
  • Asset type: URL
  • Availability requirement: 
  • Confidentiality requirement: 
  • Eligible for bounty: true
  • Eligible for submissions: true
  • Instruction: 
  • Integrity requirements: 
  • Max severity: critical