stellaprox
Newbie
- Oct 25, 2026
- 15
- 4
Hello, I am interested in a test balance. Username: stellaprox
[SOCNET SMM] ⭐️ Universal SMM Panel | YouTube, TikTok, Instagram, Telegram, Spotify, Facebook, Web Traffic... | Low Prices, High Quality
- Thread starter SocNet Store
- Start date
-
- Tags
- cheap smm panel drip feed instagram followers marketing platform reddit upvotes reseller api smm panel smm services social media marketing social media panel social media promotion socnet socnet pro socnet smm spotify plays telegram members tiktok followers twitter followers website traffic youtube views
- Aug 27, 2023
- 1,468
- 244
Credited
- Aug 27, 2023
- 1,468
- 244
Our store is running a Buy One Get One Free promotion — learn more in our Telegram channel
ximeraLOZO
Newbie
- Oct 25, 2026
- 8
- 1
Hi! Registered on your panel to test your TikTok Non-Drop followers for daily API orders.My username: John_Smith Could you please add a test balance? Thanks!
- Aug 27, 2023
- 1,468
- 244
Credited
- Aug 27, 2023
- 1,468
- 244
The thread is active and open for replies.
Send me bonus, my username/e-mail is digitalblack / [email protected]
- Aug 27, 2023
- 1,468
- 244
Credited
djvuccjrnc
Newbie
- Oct 20, 2026
- 1
- 1
Hello,
I am writing to share my recent experience participating in the bug bounty program for smm.socnet.pro, which has been deeply frustrating due to the conduct of both the development and support teams.
I submitted three vulnerabilities simultaneously: an account takeover (ATO) issue arising from a weak "forgot password" implementation—which allows an attacker to lock a user out of their account using only their email address—and a reflected host header injection. Although all three issues were eventually patched, the support team classified them as "non-functional." This assessment is difficult to reconcile with the fact that I provided a clear, detailed proof-of-concept (PoC) that worked perfectly. How they could reach such a conclusion remains unclear.
More concerningly, regarding the critical-severity issue, the support team asked, "How would an attacker even obtain the user's/target's Gmail address?" For anyone experienced in bug hunting, this question is fundamentally misguided—it demonstrates a clear lack of familiarity with OSINT (Open-Source Intelligence) and reconnaissance techniques. The same question was raised regarding the vulnerability that allows an attacker to lock a user out via their email. It is baffling that a developer would fail to consider the practical implications of such a vulnerability.
They refused to classify these as actual vulnerabilities, yet they proceeded to patch them anyway. When I challenged them—asking, "If these aren't vulnerabilities, then revert the changes; don't bother fixing them"—I received no response and no action. If they were not vulnerabilities, why fix them in the first place? This inconsistency is bizarre.
In short, they remained adamant that these were not vulnerabilities, even after having patched them. Ultimately, the reward was capped at just $50 for issues that were actually critical, medium, and high severity.
A piece of advice: if they choose to be dishonest, that very dishonesty will ultimately be their undoing.
Attachments
- Aug 27, 2023
- 1,468
- 244
Hello,
Thank you for your feedback and for taking the time to share it. We'd like to clarify our position on each point.
1. Vulnerability classification
We acknowledge that the PoCs you provided demonstrated real issues — which is precisely why we fixed them. However, our classification was based not on the existence of the problem itself, but on its practical exploitability in the context of our product. Specifically, the "forgot password" scenario requires the attacker to know the victim's email address. This reduces the practical value of the vulnerability from our perspective — not because we don't understand OSINT, but because it doesn't create a mass attack vector for our service. We understand that in bug bounty this approach may raise questions, and we accept that.
2. Why we fixed it if we didn't classify it as a vulnerability
The fix was preventive. Even if we didn't classify the issue as critical, the mere fact of its existence is sufficient reason to eliminate it. This is not a contradiction: we can disagree with the severity assessment while still removing the risk. Rolling back fixes just to prove a point would be irresponsible toward our users.
3. Reward
The reward amount ($50) reflects our internal assessment of the combined criticality of the three issues, taking into account their practical exploitability in our environment. We understand this may seem low, and we accept the criticism.
Separately, we'd like to note: we are a young service that is still growing. Unfortunately, we cannot afford to pay huge bounties for discovered vulnerabilities the way large corporations with multi-million-dollar security budgets do. Our payments are a sincere thank-you for helping improve the service, not a commercial valuation of your work. We value every contribution, but our financial capabilities are limited.
4. What we've taken from this
Your feedback showed that our assessment criteria and communication with researchers need improvement. We are revising our approach to classification and will be clearer about why a given issue receives a particular rating.
Thank you for your contribution — the fixes have genuinely improved the security of our service.
Best regards,
The SOCNET Team
- Aug 27, 2023
- 1,468
- 244
1+1 and SMM PANEL / MARKETPLACE PROMO-CODES in our Telegram Channel
Subscribe
Subscribe
blackhatbr
Regular Member
- Aug 2, 2016
- 262
- 38
