$$$ XBLS.NiNJA BUG BOUNTY $$$ MAXÂ REWARD: $2250 BTC

[Juice2]

Anyone Here got what it Takes ? Earn yourself some BTC .
(Note)
( Not My Server )
/// ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ $$$$$ * !XBLS.NiNJA BUG BOUNTY! * $$$$$ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \\\\
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ UPDATED: AUGUST 2017 - BIGGER REWARDS! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Calling all penetration testers, whitehats, bl4ckh4t h4ck3rz, and script kiddies!
Anyone who finds a vulnerability on either of my servers will be eligible to win a bounty paid in BITCOIN after privately disclosing and demonstrating an attack. Email PoC or proof of successful attack to [email protected], or AIM @ XBL.NiNJA, or join https://chat.xbls.ninja
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ REWARDS FOR EACH CATEGORY ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* DoS/DDoS: LOL DON'T MAKE ME LAUGH SKIDS
* r00t exploit OR shell running as "ninja" on VPS #1: $2250 BTC (OR 2 x *free* lifetime on NiNJA - $4000 value!)
* r00t exploit on VPS #2: $2000 (OR *free* lifetime on NiNJA - $2000 value!)
* SQL injection: $750 (full read access to sensitive columns/tables)
* Remote file inclusion: $750 (SHELL or perl/python/php/c bot execution)
* Local file inclusion: $700 (sensitive php source or password hashes)
* Cross-site scripting: $200 (must be harmful in some way, message boxes/dumb shit don't count)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ FAQ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Q: What kind of CDN/WAF are you running?
A: The main NiNJA website (VPS #2) is behind Cloudflare CDN+Sucuri CDN/WAF. VPS #1 is behind Cloudflare CDN.
Q: What kind of DDoS protection do you have?
A: Both servers are on a USA-based port mirror of Voxility, and both have it's full DDoS mitigation capacity (~500gbps).
Q: Do I get anything for DoS/DDoS?
A: See above. LOLNO.
Q: So what appliations/services do you have running? What version are they?
A: Check below!
Q: Giving us so much information takes the fun out of it/might be fake/seems stupid. Why?
A: Providing all this information is giving you a higher chance of success. I want to find and fix any bugs. The info is real.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
VPS #1 (primary.xbls.ninja // socket listener, http listener, and administration panel):
Kernel: 4.9.24-grsec-xbls.ninja-is.too.1337-weed.is.tight.420.blaze.it #1 SMP Thu Apr 27 04:08:57 MDT 2017 x86_64 GNU/Linux
Software versions:
* OpenSSH 7.4p1-10+deb9u1
* OpenSSL 1.0.2l 25 May 2017
* nginx/1.13.3
* PHP 7.0.19-1 (fpm-fcgi) (built: May 11 2017 14:04:47)
* Exim version 4.89 #2 built 14-Jun-2017 05:03:07
* Python 2.7.13
[[email protected] ~]# netstat -tulnap|grep LISTEN
// local only
tcp 127.0.0.1:25 0.0.0.0:* LISTEN 1908/exim4
tcp 127.0.0.1:7777 0.0.0.0:* LISTEN 1582/php-fpm.conf)
tcp 127.0.0.1:7778 0.0.0.0:* LISTEN 1582/php-fpm.conf)
tcp 127.0.0.1:7779 0.0.0.0:* LISTEN 1582/php-fpm.conf)
// externally accessible :
tcp 0.0.0.0:**** 0.0.0.0:* LISTEN 1599/sshd
tcp 0.0.0.0:9768 0.0.0.0:* LISTEN 1956/python
tcp 0.0.0.0:9769 0.0.0.0:* LISTEN 1945/python
// don't bother with this IP, non-Cloudflare traffic is dropped on 80/443 :
tcp ***.***.***.**:443 0.0.0.0:* LISTEN 1695/nginx.conf
tcp ***.***.***.**:80 0.0.0.0:* LISTEN 1695/nginx.conf
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
VPS #2 (www.xbls.ninja // website, web IRC, and IRCd):
Kernel: 4.9.24-grsec-xbls.ninja-is.too.1337-weed.is.tight.420.blaze.it #1 SMP Thu Apr 27 04:10:14 MDT 2017 x86_64 GNU/Linux
Software versions:
* OpenSSH 7.4p1-10+deb9u1
* OpenSSL 1.0.2l 25 May 2017
* nginx/1.13.3
* PHP 7.0.19-1 (fpm-fcgi) (built: May 11 2017 14:04:47)
* Exim version 4.89 #2 built 14-Jun-2017 05:03:07
* mysqld Ver 5.7.19
* WordPress 4.8.1
* WooCommerce 3.1.1
* InspIRCd-2.0.24
* Anope 2.0.5
* nodejs v7.10.1
* thelounge v2.3.2
[[email protected] ~]# netstat -tulnap|grep LISTEN
// local only
tcp 127.0.0.1:25 0.0.0.0:* LISTEN 25045/exim4
tcp 127.0.0.1:3306 0.0.0.0:* LISTEN 1525/mysqld
tcp 127.0.0.1:7000 0.0.0.0:* LISTEN 12503/inspircd
tcp 127.0.0.1:7776 0.0.0.0:* LISTEN 2614/php-fpm.conf)
tcp 127.0.0.1:7780 0.0.0.0:* LISTEN 1148/php-fpm: pool
tcp 127.0.0.1:9000 0.0.0.0:* LISTEN 5454/nodejs
// externally accessible :
tcp 209.141.39.114:6667 0.0.0.0:* LISTEN 12503/inspircd
tcp 209.141.39.114:6697 0.0.0.0:* LISTEN 12503/inspircd
tcp 0.0.0.0:22 0.0.0.0:* LISTEN 19264/sshd
// don't bother with this IP, non-Sucuri traffic is dropped on 80/443 :
tcp 209.141.39.114:80 0.0.0.0:* LISTEN 2324/nginx: worker
tcp 209.141.39.114:443 0.0.0.0:* LISTEN 2324/nginx: worker