feat: Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine #1410

null-ref-0000 · 2024-08-31T19:11:41Z

github-actions · 2024-08-31T19:11:51Z

Woohoo @null-ref-0000! 🎉 You've just dropped some hot new code! 🔥

Hang tight while we review this! You rock! 🤘

yogeshojha · 2024-09-01T00:19:49Z

@null-ref-0000 Excellent PR. I reviewed your PR and we need to make some changes. You do not have to worry as I will be making the required changes here is what I will do.

The endpoints are authenticated endpoints, likely we need api keys from hackerone. Though we have a hackerone key input in report section but that is for different purpose for reporting, so we will have to take this api input to API Vault section. This includes for both btw, we will have one input for hackerone API key which will be utilized by both reporting and syncing the bookmarked organizations.
I will also add Sync option under Quick Add option for us to be able to manually sync the targets
Since we will be utilizing the hackerone api already, it is a better idea for user to be able to import targets not only from bookmarked ones but we should let them search the target and import.
For example while adding the target we can have a search box that will search and import targets, we should let user's which targets to import.
We will take the logic out of celery as it will be an overkill for this feature, I will put it inside api/views

I will take care of this changes today.

Rest, I must say an excellent feature and amazing PR! Loved it.

if you can help me with bugcrowd as well, let me know I havent used bugcrowd yet, or maybe even other bug bounty platforms like intigriti, see if we can use them somehow with this feature.

yogeshojha · 2024-09-01T12:10:03Z

docker-compose.yml

@@ -37,7 +37,7 @@ services:
      - tool_config:/root/.config
      - static_volume:/usr/src/app/staticfiles/
    environment:
-      - DEBUG=0


my bad, forgot to revert this back after troubleshooting.

yogeshojha · 2024-09-01T12:20:17Z

Unnecessary changes have been now removed, we can consider this as an excellent base to start with.

null-ref-0000 · 2024-09-01T22:58:16Z

I'll start working on similar features for bugcrowd and intigriti. Will submit individual feature requests and PRs.

"We will take the logic out of celery as it will be an overkill for this feature, I will put it inside api/views"

If we expand this won't it be useful for this to run as background job ? When building it, I had it in the api/views but thought maybe was better as background job as we reaching out to external APIs. The H1 APIs are fast, but as this feature expands the time to synchronize could grow and thus user waiting on the UI might be a bad experience ?

"Since we will be utilizing the hackerone api already, it is a better idea for user to be able to import targets not only from bookmarked ones but we should let them search the target and import.
For example while adding the target we can have a search box that will search and import targets, we should let user's which targets to import."

Yeah great idea. But instead of targets, perhaps we perform this search at the program\organization level ? Searching all the scopes in H1 and in the the future other programs might be difficult depending on the API interface of the bug bounty programs.

…endpoints for getting bookmarked programs, programs with bounty, and all programs

yogeshojha · 2024-09-02T16:49:25Z

@null-ref-0000 Look how excellent this PR has turned out! ;p

null-ref-0000 · 2024-09-02T16:53:29Z

Wow, looks amazing!

…ram_tasks, on ui make import button functionable

yogeshojha · 2024-09-04T15:43:16Z

Hey @null-ref-0000 this turned out to be more complex than I thought;p

Check this out. If you have time, please test this out and let me know. But I want to let you know that this is a game-changing feature. Kudos to the submission!!!

Screencast.from.2024-09-04.21-10-41.mp4

This is automation to the next level ;p

yogeshojha · 2024-09-05T01:53:10Z

@null-ref-0000 this is now ready and turned out really excellent.

If you can test it out and let me know otherwise check these videos out, what do you think?

For Importing Programs

Screencast.from.2024-09-05.07-18-28.mp4

For syncing Bookmarked Programs

Screencast.from.2024-09-05.07-20-29.mp4

If everything is good, I will go ahead and merge, in next release I will target for intigriti, checked out their API looks good!

github-actions · 2024-09-05T14:23:24Z

Holy smokes! 🤯 You've just made reNgine even more awesome!

Your code is now part of the reNgine hall of fame. 🏆

Keep the cool ideas coming - maybe next time you'll break the internet! 💻💥

Virtual high fives all around! 🙌

yogeshojha · 2024-09-05T14:24:54Z

@null-ref-0000 I have merged this in the release/2.2.0 branch

If you wish to test please test it out on release/2.2.0 and let me know.

Once again, thank you for this awesome feature request as well as initiating this PR! A huge thanks 🚀

null-ref-0000 · 2024-09-06T02:21:28Z

@yogeshojha I've started testing, here's my observations:

sync process is adding out of scope assets from H1.
its not adding wildcard assets.
I also noticed we don't set a description on the organizations, should we indicate something like synced from h1 bookmarks or imported from h1 ?
sync process is not removing unbookmarked programs

I'll continue to test, and follow up with any additional observations.

Btw on a future note bugcrowd doesn't have an API for security researchers. Intigriti does so we should be able to add a similar feature for that bug bounty program.

yogeshojha · 2024-09-06T02:23:08Z

@null-ref-0000 that's an interesting observation, do you know what keys are set for out of scope? Also for description yes I will add that.

Overall ui and performance what do you think of it?

yogeshojha · 2024-09-06T02:27:06Z

@null-ref-0000 Yes Intrigiti is super simple to implement as well, I checked it out yesterday. I will target for 2.3 next month for intigriti.

null-ref-0000 · 2024-09-06T02:50:39Z

Over all UI performance is excellent, the touches you have added for notifications make for a good user experience.

"eligible_for_submission": false is the key for out of scope assets.

This key is return from the https://api.hackerone.com/v1/hackers/programs/{PROGRAM} API under "relationships": { "structured_scopes": { "data": [

null-ref-0000 · 2024-09-06T03:05:27Z

If you looking for a program of the wild card issue, Sephora is a good public program. In this case it has one wildcard, and it doesn't even import because of the issue. In my orginal code I stripped out https://*. or *. from the wild card assets. I think its important that we support this asset type.

null-ref-0000 · 2024-09-06T03:10:19Z

For the out of scope issue, REI is a good program that highlights that issue. As they have 18 out of scope assets.

yogeshojha · 2024-09-06T09:14:22Z

@null-ref-0000 I have fixed them up, however

sync process is not removing unbookmarked programs: this one will require a lot of work, plus we also need to provide user if they want to remove the program that are unbookmarked, so lets target this for another release, I have noted this already, will be creating feature request
its not adding wildcard assets: now its supported, however . we cant identify main domain, so it doesn't import, otherwise I checked for domains like *.hello.com its importing successfully
I also noticed we don't set a description on the organizations, should we indicate something like synced from h1 bookmarks or imported from h1 ?: this has been added

For out of scope domains, this has been fixed as well

If you want to test out, fetch the latest 2.2.0 branch there all these changes have been merged.

yogeshojha · 2024-09-09T11:34:43Z

@null-ref-0000 hey man what's your twitter id? since I will be posting this release update on twitter, I would like to give you a shoutout!

null-ref-0000 · 2024-09-09T12:34:14Z

on twitter @null_ref_0000

…

On Mon, Sep 9, 2024, 06:35 Yogesh Ojha ***@***.***> wrote: @null-ref-0000 <https://github.com/null-ref-0000> hey man what's your twitter id? since I will be posting this release update on twitter, I would like to give you a shoutout! — Reply to this email directly, view it on GitHub <#1410 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABDE5EPCXRYN3AASTCN7SKLZVWBWVAVCNFSM6AAAAABNODN7SGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGMZXHA3TANBXGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

yogeshojha · 2024-09-09T14:36:22Z

Hey @null-ref-0000 am I missing something?

adding logic for a new feature to sync hackerone bookmarks

ba162e5

yogeshojha changed the base branch from master to release/2.2.0 September 1, 2024 12:05

yogeshojha self-assigned this Sep 1, 2024

yogeshojha added the release/2.2.0 label Sep 1, 2024

Merge branch 'release/2.2.0' into feature/h1BookmarkSync

cb6e8eb

yogeshojha reviewed Sep 1, 2024

View reviewed changes

yogeshojha added 2 commits September 1, 2024 17:47

revert back unnecessary changes

b16c112

remove unused worker

6367900

yogeshojha marked this pull request as draft September 2, 2024 00:07

yogeshojha added 15 commits September 2, 2024 06:51

update onboarding screen

381b6ea

finalize onboarding design to accomodate accordion

148031a

Add hackerone username key field in onboarding screen

0eabb98

Added hackerone key/user model and populate in onboarding screen

27325ba

Add hackerone api key section in api vault

1b99175

Add send_report field to enable/disable automated vuln submission in h1

5a69889

fix condition to send report

bc68bf1

fix hackerone send report task to use new api key model

7970bbe

add test hackerone keys in api vault

d2f3bd1

create serializers for hackerone program attributes

f9ecd61

enable caching for 30 mins

789efb5

add api endpoints to fetch hackerone programs, this include mainly 3 …

2ea5b7e

…endpoints for getting bookmarked programs, programs with bounty, and all programs

remove debug code

51e307a

add bountyhub

7dbcf19

Add dummy program and list program url

095fed5

yogeshojha added 4 commits September 4, 2024 09:43

implement click import functionality

4f7d0b1

Added celery worker for shared api tasks, added import hackerone_prog…

9e2c760

…ram_tasks, on ui make import button functionable

bulk save/import targets

76a3660

fix organization import

81a7d3c

yogeshojha added 6 commits September 4, 2024 21:17

remove debug code

f115029

Added sync program endpoint

8231a7d

fix sync process and apt notification message

e237b00

fix errors when api keys are not set

459ef1a

fix hackerone api key not set in vault

2afc16d

fix errors on invalid h1 key

79f0944

yogeshojha changed the title ~~adding logic for a new feature to sync hackerone bookmarks~~ Introducing Bounty Hub, a central hub to import your hackerone programs to reNgine Sep 5, 2024

yogeshojha added the release-ready label Sep 5, 2024

yogeshojha marked this pull request as ready for review September 5, 2024 01:47

yogeshojha changed the title ~~Introducing Bounty Hub, a central hub to import your hackerone programs to reNgine~~ Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine Sep 5, 2024

yogeshojha merged commit 00f3b57 into yogeshojha:release/2.2.0 Sep 5, 2024
2 checks passed

yogeshojha changed the title ~~Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine~~ feat: Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine Sep 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine #1410

feat: Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine #1410

null-ref-0000 commented Aug 31, 2024

github-actions bot commented Aug 31, 2024

yogeshojha commented Sep 1, 2024

yogeshojha Sep 1, 2024

null-ref-0000 Sep 1, 2024

yogeshojha commented Sep 1, 2024

null-ref-0000 commented Sep 1, 2024

yogeshojha commented Sep 2, 2024

null-ref-0000 commented Sep 2, 2024

yogeshojha commented Sep 4, 2024 •

edited

Loading

yogeshojha commented Sep 5, 2024

github-actions bot commented Sep 5, 2024

yogeshojha commented Sep 5, 2024

null-ref-0000 commented Sep 6, 2024 •

edited

Loading

yogeshojha commented Sep 6, 2024

yogeshojha commented Sep 6, 2024

null-ref-0000 commented Sep 6, 2024 •

edited

Loading

null-ref-0000 commented Sep 6, 2024 •

edited

Loading

null-ref-0000 commented Sep 6, 2024

yogeshojha commented Sep 6, 2024

yogeshojha commented Sep 9, 2024

null-ref-0000 commented Sep 9, 2024 via email

yogeshojha commented Sep 9, 2024

feat: Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine #1410

feat: Introducing Bounty Hub, a central hub to import and manage your hackerone programs to reNgine #1410

Conversation

null-ref-0000 commented Aug 31, 2024

github-actions bot commented Aug 31, 2024

yogeshojha commented Sep 1, 2024

yogeshojha Sep 1, 2024

Choose a reason for hiding this comment

null-ref-0000 Sep 1, 2024

Choose a reason for hiding this comment

yogeshojha commented Sep 1, 2024

null-ref-0000 commented Sep 1, 2024

yogeshojha commented Sep 2, 2024

null-ref-0000 commented Sep 2, 2024

yogeshojha commented Sep 4, 2024 • edited Loading

yogeshojha commented Sep 5, 2024

github-actions bot commented Sep 5, 2024

yogeshojha commented Sep 5, 2024

null-ref-0000 commented Sep 6, 2024 • edited Loading

yogeshojha commented Sep 6, 2024

yogeshojha commented Sep 6, 2024

null-ref-0000 commented Sep 6, 2024 • edited Loading

null-ref-0000 commented Sep 6, 2024 • edited Loading

null-ref-0000 commented Sep 6, 2024

yogeshojha commented Sep 6, 2024

yogeshojha commented Sep 9, 2024

null-ref-0000 commented Sep 9, 2024 via email

yogeshojha commented Sep 9, 2024

yogeshojha commented Sep 4, 2024 •

edited

Loading

null-ref-0000 commented Sep 6, 2024 •

edited

Loading

null-ref-0000 commented Sep 6, 2024 •

edited

Loading

null-ref-0000 commented Sep 6, 2024 •

edited

Loading