【SRC挖洞经验】HackerOne, Bugcrowd, Intigriti资产一键收集工具

来源：
文章来自" BugBounty漏洞赏金自动化 知识星球"

 

支持收集 HackerOne, Bugcrowd, Intigriti and Immunefi 一些赏金平台资产

The ultimate scope gathering tool for HackerOne, Bugcrowd and Intigriti by sw33tLie

Usage:
  bbscope [command]

Available Commands:
  bc          Bugcrowd
  completion  generate the autocompletion script for the specified shell
  h1          HackerOne
  help        Help about any command
  immunefi    Immunefi
  it          Intigriti

Flags:
  -b, --bbpOnly            Only fetch programs offering monetary rewards
      --config string      config file (default is $HOME/.bbscope.yaml)
  -d, --delimiter string   Delimiter character used when printing multiple data using the output flag (default " ")
  -h, --help               help for bbscope
  -o, --output string      Output flags. Supported: t (target), d (target description), c (category), u (program URL). Can be combined. Example: -o tdu (default "t")
      --proxy string       HTTP Proxy (Useful for debugging. Example: http://127.0.0.1:8080)
  -p, --pvtOnly            Only fetch data from private programs
  -t, --toggle             Help message for toggle

Use "bbscope [command] --help" for more information about a command.

安装：

go install github.com/sw33tLie/bbscope@latest

觉得安装麻烦，我这里编译了个可执行文件Linux Centos环境

下载地址：https://cowtransfer.com/s/d3594eecfd7442

获取会话令牌：

HackerOne、Bugcrowd、Intigriti：登录，获取 API 令牌

用法

获取提供奖励的 HackerOne 所有范围目标

bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -b -o t

输出如下所示：

app.example.com

*.user.example.com

*.demo.com

www.something.com

 

获取所有提供奖励的私人 Bugcrowd 范围内目标

bbscope bc -t <YOUR_TOKEN> -b -p -o

获取所有 HackerOne 范围内的 Android APK

bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o t -c android

 获取所有 HackerOne 程序中的所有范围内目标

这将打印来自所有 HackerOne 程序（包括公共程序和 VDP）的范围内目标列表

bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o tdu -d ", "

获取 HackerOne 私有程序的程序 URL

bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o u -p | sort -u

bbscope h1 -t <YOUR_TOKEN> -u <YOUR_H1_USERNAME> -o u -p | sort -u