The ultimate scope gathering tool for HackerOne, Bugcrowd, Intigriti, Immunefi and YesWeHack by sw33tLie.
Need to grep all the large scope domains that you've got on your bug bounty platforms? This is the right tool for the job.
What about getting a list of android apps that you are allowed to test? We've got you covered as well.
Reverse engineering god? No worries, you can get a list of binaries to analyze too :)
Make sure you've a recent version of the Go compiler installed on your system. Then just run:
GO111MODULE=on go install github.com/sw33tLie/bbscope@latest
bbscope (h1|bc|it|ywh|immunefi) -t <YOUR_TOKEN> <other-flags>
How to get the session token:
_bugcrowd_session
cookie. NOTE: This has changed, it's not the _crowdcontrol_session
cookie anymore.Authorization: Bearer XXX
header. XXX is your tokenWhen using bbscope for HackerOne, the username flag (-u
) is mandatory.
Remember that you can use the --help flag to get a description for all flags.
Below you'll find some example commands.
Keep in mind that all of them work with Bugcrowd, Intigriti and YesWeHack subcommands (bc
, it
and ywh
) as well, not just with h1
.
bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -b -o t
The output will look like this:
app.example.com
*.user.example.com
*.demo.com
www.something.com
bbscope bc -t <YOUR_TOKEN> -b -p -o t
bbscope it -t <YOUR_TOKEN> -o tu --oos
bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o t -c android
bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o tdu -d ", "
This will print a list of in-scope targets from all your HackerOne programs (including public ones and VDPs) but, on the same line, it will also print the target description (when available) and the program's URL. It might look like this:
something.com, Something's main website, https://hackerone.com/something
*.demo.com, All assets owned by Demo are in scope, https://hackerone.com/demo
bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o u -p | sort -u
You'll get a list like this:
https://hackerone.com/demo
https://hackerone.com/something
bbscope immunefi
In an ideal world, all programs use the in-scope table in the same way to clearly show what's in scope, and make parsing easy. Unfortunately, that's not always the case.
Sometimes assets are assigned the wrong category.
For example, if you're going after URLs using the -c url
, double checking using -c all
is often a good idea.