Use h1 API token

m4ll0k · Jul 15, 2021 · fcfd09b · fcfd09b
1 parent 642762b
commit fcfd09b
Show file tree

Hide file tree

Showing 6 changed files with 507 additions and 187 deletions.
diff --git a/bbscope b/bbscope
diff --git a/cmd/h1.go b/cmd/h1.go
@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"crypto/tls"
+	b64 "encoding/base64"
 	"log"
 	"net/http"
 	"net/url"
@@ -17,15 +18,20 @@ var h1Cmd = &cobra.Command{
 	Long:  "Gathers data from HackerOne (https://hackerone.com/)",
 	Run: func(cmd *cobra.Command, args []string) {
 		token, _ := cmd.Flags().GetString("token")
+		username, _ := cmd.Flags().GetString("username")
 		categories, _ := cmd.Flags().GetString("categories")
-		noToken, _ := cmd.Flags().GetBool("noToken")
+		publicOnly, _ := cmd.Flags().GetBool("public-only")
 
 		outputFlags, _ := rootCmd.PersistentFlags().GetString("output")
 		delimiterCharacter, _ := rootCmd.PersistentFlags().GetString("delimiter")
 		proxy, _ := rootCmd.PersistentFlags().GetString("proxy")
 		bbpOnly, _ := rootCmd.Flags().GetBool("bbpOnly")
 		pvtOnly, _ := rootCmd.Flags().GetBool("pvtOnly")
 
+		if pvtOnly && publicOnly {
+			log.Fatal("Both public programs only and privates only flag true")
+		}
+
 		if proxy != "" {
 			proxyURL, err := url.Parse(proxy)
 			if err != nil {
@@ -35,13 +41,15 @@ var h1Cmd = &cobra.Command{
 			http.DefaultTransport.(*http.Transport).Proxy = http.ProxyURL(proxyURL)
 		}
 
-		hackerone.PrintAllScope(token, bbpOnly, pvtOnly, categories, outputFlags, delimiterCharacter, noToken)
+		hackerone.PrintAllScope(b64.StdEncoding.EncodeToString([]byte(username+":"+token)), bbpOnly, pvtOnly, publicOnly, categories, outputFlags, delimiterCharacter)
 	},
 }
 
 func init() {
 	rootCmd.AddCommand(h1Cmd)
-	h1Cmd.Flags().StringP("token", "t", "", "HackerOne session token (__Host-session cookie)")
+	h1Cmd.Flags().StringP("username", "u", "", "HackerOne username")
+	h1Cmd.Flags().StringP("token", "t", "", "HackerOne API token, get it here: https://hackerone.com/settings/api_token/edit")
 	h1Cmd.Flags().StringP("categories", "c", "all", "Scope categories, comma separated (Available: all, url, cidr, mobile, android, apple, other, hardware, code, executable)")
-	h1Cmd.Flags().BoolP("noToken", "", false, "Don't use a session token (aka public programs only)")
+	h1Cmd.Flags().BoolP("public-only", "", false, "Only print scope for public programs")
+
 }
diff --git a/go.mod b/go.mod
@@ -4,9 +4,11 @@ go 1.16
 
 require (
 	github.com/PuerkitoBio/goquery v1.6.1
+	github.com/digitalocean/godo v1.63.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/spf13/cobra v1.1.3
-	github.com/spf13/viper v1.7.1
-	github.com/tidwall/gjson v1.7.5
+	github.com/spf13/cobra v1.2.1
+	github.com/spf13/viper v1.8.1
+	github.com/sw33tLie/fleex v0.0.0-20210708174758-524c14fa45e5 // indirect
+	github.com/tidwall/gjson v1.8.1
 	github.com/tidwall/sjson v1.1.6
 )