Target Policy

https://hackerone.com/nicehash?type=team

---

Structured Scope

• Asset Identifier

  Asset Type

  Max Severity

• https://test.nicehash.com/shop/

  ---

  For NiceHash Shop, you can try following discount codes:
  **BB-ACTIVE** is the valid code for 50% discount, you should be able to use it.
  **BB-EXPIRED** is the expired code for 25% discount, you should not be able to use it.

  URL

  none
• nicex.com

  URL

  critical
• test.nicehash.com

  ---

  You can self register by using a valid email, Google or Apple account.
  Web client uses JavaScript to get a data from the NiceHash API and present it to the user or to get data from the user and send it to the NiceHash API.

  This is the test environment (copy of the production environment) where testnet blockchains are used , that you can acquire for free from internet faucet sites, so you can freely try to manipulate any financial transaction (deposit, withdrawal, purchase...).
  To get free test coins to your NiceHash account, after registration and login first find your NiceHash deposit address (https://test.nicehash.com/my/wallets/).
  Then do internet search for "BTC testnet faucet", open found site and enter your NiceHash deposit address - you should receive deposit of test coins from a testnet faucet to your NiceHash account in couple of hours.
  

  URL

  critical
• com.metallum.nicex

  GOOGLE_PLAY_APP_ID

  critical
• com.nicehash.NiceX

  APPLE_STORE_APP_ID

  critical
• com.nicehash.mobile

  APPLE_STORE_APP_ID

  critical
• https://api-test.nicex.com

  URL

  none
• https://api-test.nicehash.com

  URL

  critical
• https://test.nicex.com

  URL

  none
• test.nicex.com

  URL

  none
• com.nicehash.metallum

  GOOGLE_PLAY_APP_ID

  critical

Target Scope Domains

• api-test.nicehash.com
• nicex.com
• test.nicehash.com

• 15 Subdomains
• Download wordlist

---

Last Finished Scan:

---