National Basketball Association (NBA) - HackerOne Bounty Program¶

Company Profile¶

The National Basketball Association (NBA) is the premier professional basketball league in North America, consisting of 30 teams (29 in the United States and 1 in Canada). Founded in 1946, the NBA has grown into a global sports and entertainment powerhouse with billions in revenue and worldwide digital presence.

Wikipedia: https://en.wikipedia.org/wiki/National_Basketball_Association

Corporate Overview:¶

Founded: June 6, 1946 (as Basketball Association of America, became NBA in 1949)
Headquarters: New York City, New York, USA (Olympic Tower, Fifth Avenue)
Employees: ~2,000+ at league office, 30+ team organizations
Commissioner: Adam Silver (since 2014)
Organizational Structure: Private professional sports league

Financial Profile (2024):¶

Annual Revenue: ~$12 billion USD (league-wide)
Media Rights: $24 billion over 9 years (ESPN, TNT, ABC, NBA TV)
Global Reach: 200+ countries and territories
Digital Engagement: 1.9+ billion social media followers across platforms
NBA TV/Streaming: NBA League Pass global subscription service

Business Evolution & Key Milestones:¶

1946: Founded as Basketball Association of America (BAA)
1949: Merged with National Basketball League to form NBA
1992: "Dream Team" global expansion at Barcelona Olympics
1996: WNBA founded as sister league
2008: NBA China partnership and international expansion
2019: NBA 2K League (esports) launched
2020: Disney World "Bubble" during COVID-19 pandemic
2023: In-season tournament introduction, expanded international games

Key Digital Products & Services:¶

NBA.com: Primary league website and news portal
NBA App: Official mobile application for scores, news, stats
NBA League Pass: Premium streaming service for live games
NBA 2K Mobile: Official mobile gaming platform
NBA Store: Official merchandise and apparel e-commerce
NBA TV: 24/7 basketball television network
NBA Top Shot: Blockchain-based collectible highlights (partnership)

Technology Infrastructure:¶

Digital Platforms: Web, mobile apps, streaming services
E-commerce: Merchandise, tickets, NBA Store
Media Distribution: Live streaming, video-on-demand, highlights
Social Media: Massive presence across all major platforms
Gaming Integration: NBA 2K franchise, mobile games, esports
Analytics: Advanced player and game statistics platforms

Strategic Partnerships:¶

Broadcast Partners: ESPN, TNT, ABC, NBC, regional sports networks
Technology Partners: Microsoft (Azure), Cisco (networking), SAP (analytics)
Gaming Partners: Take-Two Interactive (NBA 2K), mobile game developers
International Partners: China (Tencent), Europe (various broadcasters)
Streaming Platforms: Integration with YouTube TV, Hulu, other services

HackerOne Bug Bounty Program¶

Program URL: https://hackerone.com/nba-public
Program Type: Public program
Last Updated: September 2, 2025
Status: 🚨 NEW DISCOVERY - Recently identified high-value target

Program Overview¶

The NBA operates a public bug bounty program on HackerOne focusing on securing their global digital sports and entertainment platform. This represents a significant opportunity given the NBA's massive digital footprint and global user base.

Attack Surface Enumeration (2025-09-02) - COMPREHENSIVE ANALYSIS COMPLETE¶

Discovery Statistics: - Total Subdomains: 1,132 discovered - Live Web Services: 779 active endpoints - Verified Interesting Endpoints: 5 (all properly protected) - Infrastructure Complexity: Enterprise-grade Akamai CDN with extensive service ecosystem

Technology Stack Analysis:¶

Primary CDN: AkamaiGHost (comprehensive coverage)
Security Implementation:
Strict-Transport-Security headers
Bot protection (_abck cookies, bm_sz tracking)
Content-Security-Policy enforcement
X-Frame-Options and XSS protection
Infrastructure: Varnish caching (NBA.com prod 1.7b)
Authentication: account.nba.com with pricing integration

Core Business Infrastructure Discovered:¶

🏀 Authentication & Account Services:¶

account.nba.com: Primary user authentication (redirects to watch/pricing)
auth.nba.com: Secondary authentication infrastructure
watch.nba.com: NBA League Pass subscription management

📊 API & Developer Infrastructure:¶

api.nba.com: Core API gateway (401 → developerportal.nba.com)
developerportal.nba.com: Protected developer documentation portal
GraphQL endpoints: Discovered across multiple subdomains

📧 Email & Marketing Infrastructure:¶

ablink.email.nba.com: Email delivery system
ablink.nbaemail.nba.com: NBA-specific email campaigns
ablink.wnbaemail.wnba.com: WNBA email integration
aim.nba.com: Analytics and targeting platform

🏟️ League & Team Infrastructure:¶

aguacaliente.gleague.nba.com: G-League team integration
Multiple team subdomains: 30+ team-specific services discovered
Streaming services: Video delivery and live streaming infrastructure

Intelligence Assessment¶

Strategic Value: 🚨 CRITICAL - MASSIVE ATTACK SURFACE¶

Confirmed Enterprise Infrastructure:¶

1,132 Subdomains: Largest attack surface discovered to date
779 Live Services: Extensive digital ecosystem requiring analysis
Multi-League Integration: NBA, WNBA, G-League unified infrastructure
Global Reach: International streaming, team, and partnership domains

High-Value Business Logic Targets:¶

Live Streaming Security: NBA League Pass authentication and DRM
E-commerce Vulnerabilities: Payment processing, subscription management
User Account Security: Fan profiles, social integration, payment methods
API Security: Mobile app backends, third-party integrations
Content Management: News, statistics, video content delivery systems

Research Priorities¶

🎯 Immediate Investigation Areas:¶

Scope Verification: Determine exact domains and applications in scope
Payout Structure: Analyze bounty ranges and double payout details
Attack Surface Enumeration: Comprehensive subdomain and service discovery
Technology Stack Analysis: Identify frameworks, CDNs, and infrastructure
Business Logic Mapping: Payment flows, authentication systems, streaming security

🔍 High-Impact Focus Areas:¶

Streaming Platform Security: NBA League Pass subscription bypasses, content piracy prevention
Payment Processing: NBA Store transactions, subscription billing, refund systems
User Authentication: Single sign-on across NBA properties, social media integration
Mobile Application Security: NBA App, team apps, gaming platform integrations
Content Delivery Network: Video streaming, image delivery, performance optimization

Next Phase Analysis¶

Reconnaissance Priority: 🚨 URGENT¶

Given the potential for double payouts and the NBA's massive digital infrastructure, this target requires immediate comprehensive analysis.

Strategic Questions to Resolve:¶

What specific domains and applications are in bounty scope?
What are the current payout ranges and any promotional multipliers?
How does the NBA's security posture compare to our current high-value targets?
What unique attack vectors exist in sports/entertainment digital platforms?

Reconnaissance Notes¶

Public-Safe Assessment Summary (September 2025)¶

Status: High-value target with large, complex public attack surface.

Detailed vulnerability observations, exact endpoints, headers, identifiers, and proof material are intentionally excluded from this public target wiki. Keep report-ready evidence in local private logs only, and disclose any validated issues through the official HackerOne program.

Technology Architecture Themes¶

Frontend: Modern JavaScript applications across fan engagement and content properties
API Surface: Public and authenticated API gateways serving web, mobile, and partner experiences
CDN / Edge: Enterprise CDN and bot-management controls protecting high-traffic properties
Streaming / Media: Subscription, entitlement, video delivery, and content-protection workflows
Third-Party Integrations: Interactive fan experiences, analytics, commerce, and media partners

Security Controls Observed¶

Bot and abuse protection on major properties
HTTPS and HSTS on core services
Authentication gates on protected resources
CDN-backed caching and edge controls
Content-protection mechanisms around streaming/media workflows

Comprehensive Attack Surface Analysis¶

Total Subdomains Analyzed: 1,132 domains
Live Services Discovered: 779 active endpoints
Critical Infrastructure: 47+ core business services
Development Environments: 15+ staging/dev endpoints identified
Team-Specific Services: 30+ team subdomain integrations

Recommended Next Steps¶

Verify current in-scope assets against the official HackerOne policy before testing.
Keep any vulnerability-specific notes and evidence out of public documentation.
Prioritize business-logic review of authentication, subscription, media entitlement, commerce, and mobile API flows.
Re-check the public policy periodically for payout, scope, and rule changes.

Notes¶

2026-10-11 — live program-status verification (public page re-check). The HackerOne program hackerone.com/nba-public was read-verified against the public program page on 2026-10-11: paid bounty program, Global Security Scope and Safe Harbor (GSSH) participation, and Closed Scope mode. Published 90-day average payout figures on the program page: ~$458 average bounty, ~$3k average critical, ~$8k top band, with a ~2h average first response. This resolves the open question in the Intelligence Assessment above ("What are the current payout ranges?"). Hunting-read value: short-response SLA plus closed-scope means triage is active and fast — always verify in-scope status against the generated public-scope.md snapshot before any testing, and expect quick turnaround on valid submissions.
Global Impact: NBA has worldwide audience with localized digital properties
Seasonal Traffic: Huge traffic spikes during playoffs, finals, draft
Partnership Complexity: Numerous third-party integrations create expanded attack surface
Mobile-First Strategy: Significant mobile app ecosystem across iOS/Android
Live Event Dependency: Real-time systems critical during games and events
Security Posture: Generally strong with proper authentication, but configuration issues present

Status: 🎯 HIGH-VALUE TARGET CONFIRMED - Large public attack surface; keep vulnerability-specific evidence private and disclose validated issues through HackerOne.

Current public scope¶

Verified public scope and policy

Historical research notes on this page are not verified authorization or current scope. Consult the linked public snapshot and the current HackerOne policy before testing.