Bug bounty program · HackerOne
Most upvoted reports117
- #968082ValidAnalysedCross-Site-Scripting on www.tiktok.com and m.tiktok.com leading to Data ExfiltrationTikTok · Cross-site Scripting · 2020 · needs: no account · Reflected XSS, CSRF, Account takeover chain–473votes
- #1065500ValidAnalysedMultiple bugs leads to RCE on TikTok for AndroidTikTok · Access Control · 2021 · needs: not clear from the report · Reflected XSS–371votes
- #1010522ValidAnalysed[CSRF] TikTok Careers Portal Account TakeoverTikTok · Cross-Site Request Forgery · 2020 · needs: not clear from the report · CSRF, Open redirect, Account takeover chain–366votes
- #1350887ValidAnalysedReflected XSS in TikTok endpointsTikTok · Cross-site Scripting · 2021 · needs: no account · Reflected XSS–356votes
- #1024575ValidAnalysedRCE on TikTok Ads PortalTikTok · Command and Code Injection · 2021 · needs: not clear from the report · OS command injection–312votes
- #2306491ValidAnalysedStored-XSS-ads.tiktok.comTikTok · Cross-site Scripting · 2024 · Low · needs: a user account · Stored XSS, Unsafe file upload–310votes
- #1328546ValidIncorrect authorization to the intelbot service leading to ticket informationTikTok · Authentication · 2022$15,000219votes
- #1475520ValidIDOR delete any Tickets on ads.tiktok.comTikTok · Insecure Direct Object Reference · 2022–216votes
- #1504202ValidStored XSS on TikTok AdsTikTok · Cross-site Scripting · 2022–201votes
- #1067967ValidBlocked user can see live videoTikTok · Information Disclosure · 2021$418198votes
Subdomains821
792 covered by the program's own scope · 0 first seen this week
Name suggestsAnything
821 names
| Name | Scope | First seen |
|---|---|---|
| 4b73f-seller-id.tiktok.com | In scope | 2026-11-14 |
| 72swe.tiktok.com | In scope | 2026-11-14 |
| 9e887-business.tiktok.com | In scope | 2026-11-14 |
| a07cd-ads.tiktok.com | In scope | 2026-11-14 |
| a48e6-creatormarketplace.tiktok.com | In scope | 2026-11-14 |
| a9ea0-www.tiktok.com | In scope | 2026-11-14 |
| abs-session.tiktok.com | In scope | 2026-11-14 |
| academy-outbound-ads.tiktok.com | In scope | 2026-11-14 |
| account.tiktok.com | In scope | 2026-11-14 |
| o2.ptr4323.i.account.tiktok.com | In scope | 2026-11-14 |
| tracking.infobip.account.tiktok.com | In scope | 2026-11-14 |
| o14.ptr1445.account.tiktok.com | In scope | 2026-11-14 |
| o15.ptr425.account.tiktok.com | In scope | 2026-11-14 |
| url7709.account.tiktok.com | In scope | 2026-11-14 |
| acdd8-www.tiktok.com | In scope | 2026-11-14 |
| activity.tiktok.com | In scope | 2026-11-14 |
| activity-i18n.tiktok.com | In scope | 2026-11-14 |
| activity-va.tiktok.com | In scope | 2026-11-14 |
| ads.tiktok.com | In scope | 2026-11-14 |
| ads-api.tiktok.comapi | In scope | 2026-11-14 |
| ads-service.tiktok.com | In scope | 2026-11-14 |
| url4077.ads-service.tiktok.com | In scope | 2026-11-14 |
| ads-sg.tiktok.com | In scope | 2026-11-14 |
| ads-useast2a.tiktok.com | In scope | 2026-11-14 |
| affiliate.tiktok.com | In scope | 2026-11-14 |
| affiliate-us.tiktok.com | In scope | 2026-11-14 |
| analytic.tiktok.com | In scope | 2026-11-14 |
| analytics.tiktok.com | In scope | 2026-11-14 |
| analytics-sg.tiktok.com | In scope | 2026-11-14 |
| apac-marketing.tiktok.com | In scope | 2026-11-14 |
| api.tiktok.comapi | In scope | 2026-11-14 |
| api-m.tiktok.comapi | In scope | 2026-11-14 |
| api-pns-sg.tiktok.comapi | In scope | 2026-11-14 |
| api-pns-va.tiktok.comapi | In scope | 2026-11-14 |
| api-sg.tiktok.comapi | In scope | 2026-11-14 |
| api-t.tiktok.comapi | In scope | 2026-11-14 |
| artist.tiktok.com | In scope | 2026-11-14 |
| artists.tiktok.com | In scope | 2026-11-14 |
| autodiscover.tiktok.commail | In scope | 2026-11-14 |
| b0923-seller-id.tiktok.com | In scope | 2026-11-14 |
| backend.tiktok.com | In scope | 2026-11-14 |
| biz-api.tiktok.comapi | In scope | 2026-11-14 |
| business.tiktok.com | In scope | 2026-11-14 |
| business-api.tiktok.comapi | In scope | 2026-11-14 |
| business-sso.tiktok.comauth | In scope | 2026-11-14 |
| business-sso-i18n.tiktok.comauth | In scope | 2026-11-14 |
| business-suite.tiktok.com | In scope | 2026-11-14 |
| business-tips.tiktok.com | In scope | 2026-11-14 |
| www.business.tiktok.com | In scope | 2026-11-14 |
| bussines.tiktok.com | In scope | 2026-11-14 |
| bussiness.tiktok.com | In scope | 2026-11-14 |
| careers.tiktok.com | In scope | 2026-11-14 |
| carreiras.tiktok.com | In scope | 2026-11-14 |
| carrierflow-va.tiktok.com | In scope | 2026-11-14 |
| cars-https-www.tiktok.com | In scope | 2026-11-14 |
| cc.tiktok.com | In scope | 2026-11-14 |
| creativecenter.tiktok.com | In scope | 2026-11-14 |
| creatormarketplace.tiktok.com | In scope | 2026-11-14 |
| crm.tiktok.com | In scope | 2026-11-14 |
| url116.crm.tiktok.com | In scope | 2026-11-14 |
| d77da-business.tiktok.com | In scope | 2026-11-14 |
| datahub.tiktok.com | In scope | 2026-11-14 |
| dev.tiktok.comdev | In scope | 2026-11-14 |
| developer.tiktok.com | In scope | 2026-11-14 |
| developer-sg.tiktok.com | In scope | 2026-11-14 |
| wildcard.developer-sg.tiktok.com | In scope | 2026-11-14 |
| developers.tiktok.com | Listed out of scope | 2026-11-14 |
| de-cix.dfw.tiktok.com | In scope | 2026-11-14 |
| de-cix1.dfw.tiktok.com | In scope | 2026-11-14 |
| discover.tiktok.com | In scope | 2026-11-14 |
| dm-me.tiktok.com | In scope | 2026-11-14 |
| e.tiktok.com | In scope | 2026-11-14 |
| link.e.tiktok.com | In scope | 2026-11-14 |
| effect.tiktok.com | In scope | 2026-11-14 |
| effecthouse.tiktok.com | In scope | 2026-11-14 |
| email.tiktok.com | In scope | 2026-11-14 |
| url5354.email.tiktok.com | In scope | 2026-11-14 |
| eu.tiktok.com | In scope | 2026-11-14 |
| eu-marketing.tiktok.com | In scope | 2026-11-14 |
| business-sso.eu.tiktok.comauth | In scope | 2026-11-14 |
| seller.eu.tiktok.com | In scope | 2026-11-14 |
| experiment.tiktok.com | In scope | 2026-11-14 |
| f2f3f-www.tiktok.com | In scope | 2026-11-14 |
| feelgood-api.tiktok.comapi | In scope | 2026-11-14 |
| gaming.tiktok.com | In scope | 2026-11-14 |
| getstarted.tiktok.com | In scope | 2026-11-14 |
| graph.tiktok.com | In scope | 2026-11-14 |
| hypstarcdn.tiktok.com | In scope | 2026-11-14 |
| im-api.tiktok.comapi | In scope | 2026-11-14 |
| im-api-sg.tiktok.comapi | In scope | 2026-11-14 |
| im-api-va.tiktok.comapi | In scope | 2026-11-14 |
| im-ws.tiktok.com | In scope | 2026-11-14 |
| im-ws-sg.tiktok.com | In scope | 2026-11-14 |
| im-ws-va.tiktok.com | In scope | 2026-11-14 |
| image-sg.tiktok.com | In scope | 2026-11-14 |
| image-useast2a.tiktok.com | In scope | 2026-11-14 |
| image-va.tiktok.com | In scope | 2026-11-14 |
| imap.tiktok.commail | In scope | 2026-11-14 |
| impact.tiktok.com | In scope | 2026-11-14 |
| in.tiktok.com | In scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.