Terms and Conditions

PentestingHere (pentestinghere.com) is a community platform for penetration testers and bug bounty researchers, operated from Montaza, Alexandria, Egypt. In this document "we", "us" and "the platform" mean PentestingHere; "you" means the person using the site.

These terms cover the whole site: reading it, holding an account, publishing on it, running its labs, and paying for a membership.

• Address: Montaza, Alexandria, Egypt
• Email: noreply@pentestinghere.com
• Phone: 01505986111

Using the site means you accept these terms. If you do not accept them, do not use the site.

You must be at least 16 years old to hold an account, and at least 18 (or the age of majority where you live) to buy a membership. If you use the site for an employer or a client, you confirm you may accept these terms on their behalf.

We update this document as the platform changes. The date at the top says when it last changed, and a material change is announced on the site. Continuing to use the site after a change means you accept the new version.

Registration is open and needs no invitation. Reading what is public needs no account at all.

Publishing requires a verified account, which means one real second factor: a confirmed email address, an authenticator app, or a linked Google or GitHub sign-in. That is all the "Verified" mark on a profile claims.

• One account per person. Accounts are not transferable and are not for sale.
• You are responsible for everything done through your account, and for keeping your password, second factor and recovery codes safe.
• Tell us immediately if you believe your account has been reached by someone else. We can end every session on an account, and we will if we think it has been taken.
• Impersonating another researcher, a company, or our staff is grounds for immediate suspension.

You keep ownership of everything you publish here: your findings, writeups, resources, reviews, comments and profile.

By publishing, you give us a non-exclusive, worldwide, royalty-free licence to store, display and distribute that work on the platform and in the platform's own channels (the feed, search, the sitemap and the email digest) for as long as you leave it published. You can hide or delete it at any time. Copies may survive briefly in backups and caches, and anything already sent by email cannot be recalled.

When you publish, you confirm that:

• The work is yours, or you have the right to publish it.
• You are allowed to disclose it: no NDA, programme policy or embargo you agreed to says otherwise. A finding you may not name the target of has three target settings (public, anonymised, or fully redacted), and the redaction is enforced everywhere the finding is read, not just hidden on the page. Use it.
• It contains no other person's personal data, no credentials, tokens or session material, no customer data, and no source code you do not own.
• It contains no malware and no weaponised exploit built to cause harm, and it is not defamatory, harassing, hateful, sexual or unlawful.

Reputation is computed from published work. Manufacturing it, by duplicate or empty submissions, sockpuppet accounts, coordinated voting or spam, is a suspension matter, and the points are recomputed away whether or not the account survives.

Everything published here is for education and for defensive and authorised security research.

Only test systems that you own or have explicit permission to test. Unauthorized security testing may violate applicable law. You are responsible for ensuring that you have permission before testing any system outside the labs provided by PentestingHere.

Academy labs, Scenario labs and Pro Labs are deliberately vulnerable applications. Hosted labs run as isolated, temporary instances for one person at a time; some labs can also be run on your own machine from the repository we hand you.

While you use them:

• Attack your own lab session, and nothing else. The isolation around a lab is a boundary, not a challenge.
• Do not use a lab instance as a proxy, a scanning host, a mining rig, a file store, or a way to reach anything outside it.
• Flags are generated per session. Sharing a flag, or a solution meant to defeat grading rather than to teach, forfeits the solve.
• Sessions expire, idle sessions are reclaimed, and capacity is limited. We can stop, reset or refuse a session at any time, including to keep the platform running for everybody else.
• A vulnerability in the lab runtime or in the platform itself goes to our disclosure page first, never into a writeup first.

We want reports about this site, and the page for them is open to people with no account, because the most valuable report we can receive is one about the login flow.

Test only against your own accounts and your own data, do not run destructive or automated scans against production, and do not pivot to another member's data to prove a point. We do not pay bounties today; we credit researchers, and we say so plainly rather than implying otherwise.

The platform is free. Reading, publishing, the whole written curriculum, the Academy lab catalogue and every reputation point they earn cost nothing, and they stay that way.

A paid membership unlocks the members-only practice material: the labs and lesson videos attached to the Web Application Pentester track, the members-only Scenario labs and Pro Labs, no ads, and priority when the lab runtime is busy. What each membership covers is described on the membership page.

• Price. The price, the currency and the billing period are shown on the checkout page before you pay, and nothing is charged until you confirm there. We do not advertise a figure anywhere else, because the checkout page is the only place one can be honest.
• Paying. When checkout is open, payment is taken by the payment provider shown at checkout. A membership may also be granted by our staff after a verified Egyptian bank or wallet transfer (InstaPay or Vodafone Cash) whose reference you submit to us for review.
• When it starts. Access begins when the payment is confirmed: immediately for a card payment, and after a member of staff has verified the transfer for a manual one.
• Renewal. A membership runs for the period shown at checkout. It does not renew automatically unless the checkout page says so and you agree to it there. A renewal paid early is added to the time you already have; it is not lost.
• When it lapses. Nothing you made is touched. Your solves, progress, reputation and everything you published stay exactly as they are. You stop being able to start members-only labs until you renew.
• Cancelling. You can stop a membership at any time, through the checkout provider where it was bought or by writing to us. Cancelling stops future charges; it does not shorten time already paid for.
• Refunds. Write to us within 14 days of a payment and we will refund it in full where the members-only content has not been substantially used. After 14 days, or where the members-only labs and videos have been worked through, we do not refund. Refunds go back to the account the payment came from; a fee charged by your bank or wallet is not ours to return. If we suspend an account for breaking these terms, the remaining time is not refunded.
• Disputes and reversals. We may suspend members-only access while a chargeback, a reversal or a suspected fraudulent payment is open.

If a payment provider is not connected yet, nothing on this site can take money: the Subscribe button is disabled for everybody, and no card details are collected, stored or processed by us at any point. Card details are only ever handled by the payment provider.

Reports about content go to a staff queue. Moderation hides content rather than deleting it, and hiding is reversible: you keep access to your own hidden work, you can see why it was hidden, and editing it is how you appeal.

We may warn an account, hide its content, suspend it, or end all of its sessions when these terms are broken, when the law requires it, or when a member is put at risk. Serious cases, such as publishing another person's data, attacking the platform or another member, or a payment taken fraudulently, are suspended without a warning first.

Reputation is computed from your published public work and recomputed from the underlying rows, so it moves when your work does. It is a score on this site: not a currency, not transferable, and worth no money.

"Verified" (a second factor), "Trusted" (a staff member vouched for you by hand) and "Notable" (a follower milestone) are three different marks meaning three different things. None of them is a certification, an endorsement of your skills by us, or a qualification you can present as one. We may remove a mark, or recompute a score, when the work behind it is removed or a rule was broken.

A Learn certificate of completion confirms that you completed every lesson and solved every lab of a free Learn path, or of every path in a Learn track. It is not a professional certification and is not affiliated with any certification body. Its page is public to anyone who has its link or scans its QR code, and shows the name you chose for it. We may revoke a certificate that was obtained by breaking these terms, for example by sharing lab flags.

The platform itself, its code, design, curriculum, lab material, name and logo, belongs to us or to our licensors. Quote it and link to it freely, with attribution. Do not republish the curriculum or the labs as your own, and do not sell or redistribute them.

Work published by members belongs to its authors, under the licence described above. Ask them, not us.

The site links out: to bug bounty programmes, to writeups hosted elsewhere, to video hosts, to a payment provider, and to advertising where it is shown. We do not control any of them, we are not responsible for them, and their own terms apply when you go there.

The site is provided as it is. Features arrive, change and are switched off; hosted labs in particular run on capacity that is finite and shared, and we do not promise uninterrupted service, a queue position, or that any particular lab will be running when you want it.

We may change or withdraw parts of the platform. Where a change takes away something a membership paid for, we will say so and deal with it fairly.

We store what running the platform needs: your account details, what you publish, moderation records, support tickets, records of sessions for security, page views recorded without an IP address or a tracking cookie, and the reference of a payment claim you submit.

We do not sell your data. We email you only where you asked for it or where the message is essential to your account, and every optional message carries an unsubscribe link. Your email address is shown to administrators only, never to other members.

Write to us to see what we hold about you, to correct it, or to have your account and its content removed.

The Privacy Policy is the full account: what is collected, why, what is public and what is never public, which other companies are involved, and how long any of it is kept. Where the two say anything about your data, the Privacy Policy is the one that governs.

As far as the law allows, we are not liable for indirect or consequential loss, for lost data or lost opportunity, or for anything that happens because of how you or anybody else used material published here.

Where we are liable, our total liability to you is limited to the amount you paid us in the twelve months before the claim. Nothing in these terms limits liability that cannot lawfully be limited, including liability for death, personal injury or fraud.

You can stop using the site at any time and ask us to close your account. We can suspend or end access where these terms are broken.

The sections that should outlive the account do: what you published under the licence you granted while it was published, and the limits on our liability.

If something here is unclear, or something has gone wrong, tell us. The support desk reaches a person, and almost everything is quicker to put right that way than any other.

We will always try to settle a complaint with you directly, and we would rather hear about a problem early than find out about it late.