PentestingHere
Log in Join

T-Mobile

T-Mobile on Bugcrowd · Bugcrowd Active

Official page

Scope

At a glance

  • Maximum payout: $133,700
  • Public disclosure: Not allowed
  • Managed by the platform: Yes
  • Safe harbour: Full

In scope

  • Self Register Account on T-Mobile Microsoft Entra ID
  • Cellular Network Auth Bypass via Web/Mobile App
  • T&P Servers
  • Full Corporate Network Access or Access to Sensitive Network Segments
  • https://apps.apple.com/us/app/t-life-t-mobile-tuesdays/id1111876388
  • https://play.google.com/store/apps/details?id=com.tmobile.tuesdays&hl=en_US&gl=US
  • https://account.t-mobile.com
  • https://metrobyt-mobile.com
  • https://sprint.com
  • https://t-mobile.com
  • https://api.t-mobile.com
  • https://tfb.t-mobile.com
  • https://devedge.t-mobile.com
  • https://tess.service-now.com
  • https://digits.t-mobile.com
  • https://api.vistarmedia.com
  • https://packages.cortexpowered.com
  • https://api.vistarmedia.eu
  • https://production-dynam-creative.vistarmedia.com
  • https://storybook.vistarmedia.com
  • https://creatives.vistarmedia.com
  • https://sflower.cortexpowered.com
  • https://production-delivery-metrics-svc.vistarmedia.com
  • https://maps.vistarmedia.com
  • https://transcodes-cdn.vistarmedia.com
  • https://assets-cdn.vistarmedia.com
  • https://docker-staging.adstruc.com
  • https://staging-trafficking.vistarmedia.com
  • https://job-svc-b.vistarmedia.com
  • https://docsite.vistarmedia.com
  • https://sfleet.cortexpowered.com
  • https://audience-builder.vistarmedia.com
  • https://staging-login.vistarmedia.com
  • https://clients.adstruc.com
  • https://demo.adstruc.com
  • https://*.uscc.net
  • https://*.uscc.com
  • https://*.uscellular.com
  • https://dashboard-101.moengage.com
  • https://www.assurancewireless.com

42 more assets on the official page.

Out of scope

  • *.sprint.net
  • /self-service-*
  • *.mobile.uscc.net
  • *.mobile.uscc.com
  • https://*.moengage.com
  • https://appointments.uscellular.com
  • Any domain, property, product, protocol, or service of the app/hardware/software version not explicitly listed in the In...

Imported from the public directory. Always confirm scope on the official program page before testing.

Is it worth your time?

Read the community feedback

0 reviews rating communication, triage, payouts and whether it suits beginners.

Open feedback