Table of Contents
1. Executive Summary 2
2. Methodology 4
2.1 Preparation phase 4
2.1.1 Scope 4
2.1.2 Test plan 5
2.2 Testing phase 5
2.3.1 Information gathering & reconnaissance 5
2.3.2 Penetration testing & exploitation 6
2.3 Reporting phase 7
2.4 Vulnerability classification and severity 7
2.5 HackerOne staff 8
2.6 HackerOne researchers 8
3. Findings 9
3.1 Findings Overview 9
3.1.1 Bounties paid to researchers 10
3.2 Asset: https://portal.excom.com/ 11
3.2.2 Vulnerability Summary 11
3.3 Asset: https://dashboard.excom.com/ 12
3.3.1 Vulnerability Summary 12
3.4 Asset: https://api.excom.com/ 12
3.4.1 Vulnerability Summary 12
3.5 Asset: Mobile App 13
3.5.1 Vulnerability Summary 13
Appendix A 14
HackerOne researchers 14
Appendix B 15
Bounty structure 15
1
