DataDome Bot Bounty

DataDome Bot Bounty Program

Program Description

The goal of this program is to report ways around DataDome protection by implementing a scraping bot.

DataDome publishes these websites dedicated to researchers:

• https://bounty-nodejs.datashield.co (documentation on implementation)
• https://bounty-fastly.datashield.co (documentation on implementation)
• https://bounty-nginx.datashield.co/ (documentation on implementation)

Technical Challenge

The technical challenge consists of scraping as much content as possible without being blocked by DataDome protection:

• Minimum scenario: scraping content should be 20,000 web pages in less than an hour.
• Medium scenario: 20,000 web pages scraped in 30 minutes
• High scenario: 20,000 web pages scraped in 10 minutes
• Critical scenario: 20,000 web pages scraped in less than 1 minute

Report Requirements

The report should contain:

• A basic explanation of the attack vector used.
• The code to reproduce the scraping scenario
• The IP(s) used during the attack
• The scraped content in the form of hashes contained in the page from the scraped pages (not hashes of the raw HTML files themselves) and HTTP requests return code (must be 200)
• The scraping speed (in hits per sec.)

The report will be classified as a duplicate if a previous report generated the same code fix.

Rewards

Scope

Out of Scope

• Distributed attacks (scraping must be done using only 1 IP at a time).

Vulnerability Types

Qualifying Vulnerabilities

• Program is only focused on client-side vulnerabilities or DataDome Bot Protection bypass.

Non-Qualifying Vulnerabilities

• Denial of service attacks
• Social engineering of DataDome employees and contractors
• Site vulnerabilities

Hunters Collaboration

When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.

For more information, see help center. Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.