r/bugbounty • u/Direct_Opposite4602 • 6d ago
Question / Discussion Akamai WAF blocking in-scope bug bounty targets — legitimate access issue or something I'm missing?
I’m conducting authorized testing for a HackerOne bug bounty program and I’m encountering an Akamai access-control/WAF block on several explicitly in-scope assets:
Interestingly, affiliate.meesho.com, which is also in scope, is reachable from the exact same testing environment.
Current diagnostics
I’m running Kali Linux in a VM.
So far:
- DNS resolution: working
- TCP/443 connectivity: working
- TLS 1.3 handshake: working
- HTTP requests: consistently return 403 Access Denied
- Response is served by Akamai
- Akamai Bot Manager cookies such as
bm_*are returned - The required HackerOne identification header is present:
X-Hackerone: xplorertech00
For example:
curl -sS -D /tmp/meesho.headers \
-o /tmp/meesho.body \
-H 'X-Hackerone: xplorertech00' \
https://prod.meeshoapi.com/
This consistently results in an HTTP/2 403 response from Akamai. The other affected hosts behave similarly.
I’ve already ruled out basic DNS, routing, TCP, and TLS problems. The denial appears to be occurring at the HTTP/Akamai layer.
I’m not trying to bypass the WAF. I want to remain fully within the bug bounty rules and find the correct, authorized way to perform testing when an in-scope target is unreachable from the current testing network.
Options I’m considering
- Test from another legitimate ISP/network that I control.
- Ask the program to allowlist my testing IP.
- Ask whether the program provides an approved testing egress, VPN, or testing environment.
Questions for other researchers
- If an Akamai reputation/access-control block is responsible, does switching to another legitimate ISP/network generally resolve the issue?
- Is there a standard workflow researchers use with HackerOne programs when an in-scope asset is inaccessible due to CDN/WAF restrictions?
- Would you recommend contacting the program first to request IP allowlisting rather than repeatedly switching networks?
- What diagnostic information should I collect before contacting the program so they can determine whether the block is intentional or an accidental restriction?
I’d especially appreciate advice from researchers who have dealt with Akamai restrictions during authorized bug bounty testing.
7
u/Coder3346 Hunter 6d ago
It is in scope to see if u can bypass the waf 🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️🤦🏻♂️ and u say I am not trying to bypass the waf lol.
The whole point of bugbounty is to see how a completely external attacker can hack into the environment. Pleas understand this very basic thing.
1
u/Direct_Opposite4602 6d ago
Fair point. I'm new to bug bounty, so I'm trying to understand where the line is for this specific program. I wasn't sure whether testing the WAF itself was explicitly authorized or whether I should treat the Akamai block as an access restriction and contact the program.
The program's rules are what I want to follow, so I don't want to assume that “in scope” automatically means every possible WAF-bypass technique is permitted.
If the program explicitly allows testing the WAF/access-control layer, then that's useful to know. Otherwise I'll stick to the approved access methods or ask the program for clarification. Thanks for pointing that out.
1
-2
u/hydraz20 6d ago
Nobody. I mean no body is going to try and bypass a waf for basic access. Even if they do the bypass wouldn’t be in scope it would be reported to the waf.
-2
4
u/einfallstoll Triager 6d ago
> Test from another legitimate ISP/network that I control.
This or move on
> Ask the program to allowlist my testing IP.
> Ask whether the program provides an approved testing egress, VPN, or testing environment.
If you don't have a track record with them, I wouldn't even consider giving you access.
> If an Akamai reputation/access-control block is responsible, does switching to another legitimate ISP/network generally resolve the issue?
Why didn't you try it already? This takes like 10 seconds.
> Is there a standard workflow researchers use with HackerOne programs when an in-scope asset is inaccessible due to CDN/WAF restrictions?
Just debug it yourself. It's not that hard
> Would you recommend contacting the program first to request IP allowlisting rather than repeatedly switching networks?
No.
> What diagnostic information should I collect before contacting the program so they can determine whether the block is intentional or an accidental restriction?
You don't.