{"id":13542403,"url":"https://github.com/fransr/bountyplz","last_synced_at":"2025-04-06T10:13:29.195Z","repository":{"id":138751168,"uuid":"130064378","full_name":"fransr/bountyplz","owner":"fransr","description":"Automated security reporting from markdown templates (HackerOne and Bugcrowd are currently the platforms supported)","archived":false,"fork":false,"pushed_at":"2019-05-10T07:28:08.000Z","size":2769,"stargazers_count":452,"open_issues_count":4,"forks_count":66,"subscribers_count":17,"default_branch":"master","last_synced_at":"2025-03-30T08:12:18.731Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fransr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-04-18T13:11:54.000Z","updated_at":"2025-03-28T21:52:02.000Z","dependencies_parsed_at":null,"dependency_job_id":"b8ee923e-4236-4d79-8e53-fd0e958e68d2","html_url":"https://github.com/fransr/bountyplz","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fransr%2Fbountyplz","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fransr%2Fbountyplz/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fransr%2Fbountyplz/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fransr%2Fbountyplz/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fransr","download_url":"https://codeload.github.com/fransr/bountyplz/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247464223,"owners_count":20942970,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T10:01:06.408Z","updated_at":"2025-04-06T10:13:29.168Z","avatar_url":"https://github.com/fransr.png","language":"Shell","funding_links":[],"categories":["Shell","Miscellaneous","Weapons","Shell (473)"],"sub_categories":["Uncategorized","Tools"],"readme":"# bountyplz – automated security reporting from markdown templates\n\n### description\n\nThis is a project created by [Frans Rosén](https://twitter.com/fransrosen). The idea is to be able to submit a report without any interaction. It's taking advantage of all features the existing site has, such as attachments, inline images, assets, weaknesses and severity.\n\nbountyplz supports submitting to HackerOne and Bugcrowd.\n\nbountyplz will sign in to HackerOne or Bugcrowd and keep the session, create a draft and submit the report, all in one step. It also supports 2FA, if this is enabled on your HackerOne- or Bugcrowd-account.\n\nHackerOne:\u003cbr /\u003e\n\u003cimg src=\"https://github.com/fransr/bountyplz/raw/documentation-files/preview/preview1.png\" width=\"700\" /\u003e\n\nBugcrowd:\u003cbr /\u003e\n\u003cimg src=\"https://github.com/fransr/bountyplz/raw/documentation-files/preview/preview3.png\" width=\"700\" /\u003e\n\n### install\n\n```\nbrew install jq\nbrew install gnu-sed\nbrew install coreutils\n\nln -fs \"$(pwd)/bountyplz\" /usr/local/bin/bountyplz\n```\n\n### usage HackerOne `h1`\n\nPlace `.env` with `HACKERONE_USERNAME` and `HACKERONE_PASSWORD` next to the binary.\n\n```\nbountyplz h1 \u003cprogram\u003e \u003cmarkdown-file\u003e\n```\n\n`-p` for preview\u003cbr /\u003e\n`-d` for draft-only\u003cbr /\u003e\n`-f` for force\n\n### usage Bugcrowd `bc`\n\nPlace `.env` with `BUGCROWD_USERNAME` and `BUGCROWD_PASSWORD` next to the binary.\n\n```\nbountyplz bc \u003cprogram\u003e \u003cmarkdown-file\u003e\n```\n\n`-p` for preview\u003cbr /\u003e\n`-d` for draft-only (will upload files but not save any draft as this is currently not supported on Bugcrowd)\u003cbr /\u003e\n`-f` for force\n\n### howto\n\nWrite report in markdown, use frontmatter for attributes for the report. The title of the report will be taken from the content's first #-header.\n\n```md\n---\nseverity: high\nweakness: xss reflected\nasset: example.com\n---\n\n# Report title\n\nReport description\n```\n\nThe following attributes are currently supported:\n\n| key   | type | desc |\n|-------|------|---|\n|`asset`|string|will be matched against the list of assets for the program|\n|`weakness`|string|will be matched against the list of weaknesses for the program. |\n|`attachments`|json-array|list of files that should be attached. `[\"test.jpg\",\"test2.jpg\"]`\u003cbr /\u003eif images and videos are used inline, these does not need to be in this list|\n|`url`|string|bug URL (BugCrowd only, not required)|\n|`severity`|string|`none, low, medium, high, crical` (HackerOne only)|\n\nWhen the report is submitted, an additional `report`-attribute will be added to the markdown with the reference URL for the report. This is to make sure the same report is not submitted twice.\n\n`asset` and `weakness` will try to match against the list of available options. If multiple results are found, a list will be shown to select the right one:\n\n\u003cimg src=\"https://github.com/fransr/bountyplz/raw/documentation-files/preview/preview2.png\" width=\"300\" /\u003e\n\n### impact\n\nFor HackerOne, if any header with the word `impact` exist in the report, the report will be split in half and the content after Impact will be inserted in the Impact-field. If no Impact exists in the report, the Impact field will only contain a `#` rendering it empty.\n\n```md\n---\nasset: example.com\n---\n\n# Report title\n\nReport description\n\n### impact\n\nThis will be in the impact field.\n```\n\nFor Bugcrowd, the whole report will be inside the Description-field.\n\n### inline attachments\n\nWhen referring to images or videos inside the report, use this format: `\u003cimg upload src=\"x.jpg\" /\u003e`\n\nEvery image or video element containing `\u003cimg|video upload` will be extracted from the report and uploaded automatically. The location of the file referenced will always be relative to the markdown-file, and the preview before submitting will make sure all files exists.\n\n### preview `-p`\n\nYou can preview the report before sending it using:\n\n```\nbountyplz h1 yahoo -p test/report1.md\n```\n\nThis will not submit the report, but show you how the report was parsed.\n\n### draft-only `-d`\n\nYou can submit the report as a draft only using:\n\n```\nbountyplz h1 yahoo -d test/report1.md\n```\n\n*Please note that Asset and Severity are not currently possible to save in the draft on HackerOne*.\n\n### force `-f `\n\nWhenever a file has been reported, the markdown-file is being modified to add a reference to the report-URL inside the frontmatter called `report: URL`. This is to prevent the report from being submitted again. By using `-f` you can force the report to be submitted, even if it has a `report:`-entry in the frontmatter. Use with caution to prevent duplicate reports.\n\n### batch\n\nThis command will run all markdown files and report them. If a report already has a \"report: \"-reference in it, the report will not be sent.\n\n```\nfind . -name \"*.md\" \\( -exec bountyplz h1 \u003cprogram\u003e {} \\; -o -quit \\)\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffransr%2Fbountyplz","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffransr%2Fbountyplz","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffransr%2Fbountyplz/lists"}