HackerOne
HackerOne integration allows users to fetch reports by using the fetch incidents capability. It also provides commands to retrieve all the reports and programs.
Vulnerability Management · HackerOne
Details
| ID | HackerOne |
|---|---|
| Provider | HackerOne |
| Category | Vulnerability Management |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
HackerOne integration allows users to fetch reports by using the fetch incidents capability. It also provides commands to retrieve all the reports and programs.
This integration was integrated and tested with API version v1 of HackerOne.
Advanced Filter
Theadvanced_filter parameter used both in the hackerone-report-list command and in the integration configuration, is used to filter results based on attribute values.
The general filtering syntax is as follows:
{"attribute": "value1, value2"}
attributeis the name of the attribute that the filter will be applied against.valueis the value being checked for. You can specify multiple values as a comma-separated list for the attributes that are accepting the multiple values according to the API document.- To specify multiple filters, use the comma ( , ) to separate them
(for example,{"attribute1": "value1, value2", "attribute2" : "value3, value4"}).
To get the detailed information regarding the valid attributes for filtering user can refer to the HackerOne API documentation.
Configure HackerOne in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | Server URL to connect to HackerOne. | True |
| Username | The username of the user. | True |
| Maximum number of incidents per fetch | The maximum limit is 100. | False |
| First fetch time interval | Date or relative timestamp to start fetching incidents from. Formats accepted: 2 minutes, 2 hours, 2 days, 2 weeks, 2 months, 2 years, yyyy-mm-dd, yyyy-mm-ddTHH:MM:SSZ, etc |
False |
| Program Handle | Fetches reports based on the specified program handle. Supports comma separated values. Note: To get program handle, use the “hackerone-program-list” command. |
True |
| State | Fetches reports based on the specified report state. Note: Supports comma separated values. |
False |
| Severity | Fetches reports based on severity ratings of the report. Note: Supports comma separated values. |
False |
| Advanced Filters | By providing advanced filters users can get specific reports according to their requirements. Supports JSON format. Note: This will take higher precedence over “Program Handle”, “State” and “Severity”. Format accepted: {“filter[attribute1][]”: “value1, value2”, “filter[attribute2]” : “value3”} For example: {“filter[closed_at__gt]” : “2020-10-26T10:48:16.834Z”, “filter[state][]” : “new, triaged”} To know more visit: https://api.hackerone.com/customer-resources/#reports-get-all-reports. |
False |
| Use system proxy settings | False | |
| Trust any certificate (not secure) | False | |
| Incident type | False | |
| Fetch incidents | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
hackerone-report-list
Retrieves all the reports based on program handle and provided arguments.
Base Command
hackerone-report-list
Input
| Argument Name | Description | Required |
|---|---|---|
| program_handle | The program handle to fetch the reports based on the specified handle. Users can get the list of the program_handle by executing the “hackerone-program-list” command. Note: Supports comma separated values. |
Required |
| sort_by | Sort the reports based on the attributes provided. Possible values: swag_awarded_at, bounty_awarded_at, last_reporter_activity_at, first_program_activity_at, last_program_activity_at, triaged_at, created_at, closed_at, last_public_activity_at, last_activity_at, disclosed_at. Note: The default sort order for an attribute is descending. Prefix the attributes with a hyphen to sort in ascending order. Supports comma separated values. Example: -last_reporter_activity_at, created_at. |
Optional |
| page_size | The number of reports to retrieve per page. Default value is 50. Note: Possible values are between 1 and 100. |
Optional |
| page_number | Page number to retrieve the reports from the specified page. Default value is 1. | Optional |
| advanced_filter | By providing advanced filters, users can get specific reports according to their requirements. Supports JSON format. Note: This will take higher precedence over “program_handle”, “filter_by_keyword”, “state” and “severity”. Format accepted: {“filter[attribute1][]”: “value1, value2”, “filter[attribute2]” : “value3”} For example: {“filter[closed_at__gt]”:”2020-10-26T10:48:16.834Z”,”filter[state][]”:”new, triaged”}. |
Optional |
| filter_by_keyword | The keyword filter to retrieve the reports by title and keywords. | Optional |
| state | The state filter to retrieve the reports by current report state. Possible values: new, pending-program-review, triaged, needs-more-info, resolved, not-applicable, informative, duplicate, spam, retesting. Note: Supports comma separated values. |
Optional |
| severity | The severity filter to retrieve the reports by the severity ratings. Possible values: none, low, medium, high, critical. Note: Supports comma separated values. |
Optional |
| limit | Number of reports to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| HackerOne.Report.id | String | The unique ID of the report. |
| HackerOne.Report.type | String | The type of the object of HackerOne. |
| HackerOne.Report.attributes.title | String | The title of the report. |
| HackerOne.Report.attributes.state | String | The state of the Report. It can be new, pending-program-review, triaged, needs-more-info, resolved, not-applicable, informative, duplicate, spam or retesting. |
| HackerOne.Report.attributes.created_at | Date | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.vulnerability_information | String | Detailed information about the vulnerability including the steps to reproduce as well as supporting material and references. |
| HackerOne.Report.attributes.triaged_at | Date | The date and time the object was triaged. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.closed_at | Date | The date and time the object was closed. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.last_reporter_activity_at | String | The date and time that the most recent reporter activity was posted on the report. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.first_program_activity_at | String | The date and time that the first program activity was posted on the report. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.last_program_activity_at | String | The date and time that the most recent program activity was posted on the report. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.bounty_awarded_at | String | The date and time that the most recent bounty was awarded on the report. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.swag_awarded_at | String | The date and time that the most recent swag was awarded on the report. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.disclosed_at | String | The date and time the report was disclosed. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.reporter_agreed_on_going_public_at | String | The date and time the reporter agreed for the public disclosure. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.last_public_activity_at | String | The date and time that the most recent public activity was posted on the report. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.last_activity_at | String | The date and time that the most recent activity was posted on the report. Formatted according to ISO 8601. |
| HackerOne.Report.attributes.source | String | A free-form string defining the source of the report for tracking purposes. For example, “detectify”, “rapid7” or “jira”. |
| HackerOne.Report.attributes.timer_bounty_awarded_elapsed_time | Number | The total number of seconds that have elapsed between when the timer started and when it stopped ticking. The timer does not take weekends into account. If the field is null and the corresponding miss_at field is set, it means the timer is still counting. |
| HackerOne.Report.attributes.timer_bounty_awarded_miss_at | Date | The date and time the system expects the program to have awarded a bounty by. The field is null when the system does not expect the report to receive a bounty at the time. |
| HackerOne.Report.attributes.timer_first_program_response_miss_at | Date | The date and time the system expects the program to have posted an initial public comment to the report by. |
| HackerOne.Report.attributes.timer_first_program_response_elapsed_time | Number | The total number of seconds that have elapsed between when the timer started and when it stopped ticking. The timer does not take weekends into account. If the field is null and the corresponding miss_at field is set, it means the timer is still counting. |
| HackerOne.Report.attributes.timer_report_resolved_miss_at | Date | The date and time the system expects the program to have closed the report by. The field is null when the report seems blocked by the reporter. |
| HackerOne.Report.attributes.timer_report_resolved_elapsed_time | Number | The total number of seconds that have elapsed between when the timer started and when it stopped ticking. The timer does not take weekends into account. If the field is null and the corresponding miss_at field is set, it means the timer is still counting. |
| HackerOne.Report.attributes.timer_report_triage_miss_at | Date | The date and time the system expects the program to have triaged the report by. The field is null when the system does not expect the report to be triaged at the time. |
| HackerOne.Report.attributes.timer_report_triage_elapsed_time | Number | The total number of seconds that have elapsed between when the timer started and when it stopped ticking. The timer does not take weekends into account. If the field is null and the corresponding miss_at field is set, it means the timer is still counting. |
| HackerOne.Report.relationships.reporter.data.id | String | The unique ID of the reporter. |
| HackerOne.Report.relationships.reporter.data.type | String | The type of the object of HackerOne. |
| HackerOne.Report.relationships.reporter.data.attributes.username | String | The username of the reporter. |
| HackerOne.Report.relationships.reporter.data.attributes.name | String | The name of the reporter. |
| HackerOne.Report.data.relationships.reporter.data.attributes.disabled | Boolean | Indicates if the reporter is disabled. |
| HackerOne.Report.data.relationships.reporter.data.attributes.created_at | String | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.reporter.data.attributes.profile_picture.62x62 | String | URL of the profile photo of a reporter of size 62x62. |
| HackerOne.Report.data.relationships.reporter.data.attributes.profile_picture.82x82 | String | URL of the profile photo of a reporter of size 82x82. |
| HackerOne.Report.data.relationships.reporter.data.attributes.profile_picture.110x110 | String | URL of the profile photo of a reporter of size 110x110. |
| HackerOne.Report.data.relationships.reporter.data.attributes.profile_picture.260x260 | String | URL of the profile photo of a reporter of size 260x260. |
| HackerOne.Report.data.relationships.reporter.data.attributes.bio | String | The reporter’s biography, as provided by the reporter. |
| HackerOne.Report.data.relationships.reporter.data.attributes.reputation | Number | The reputation of the reporter. |
| HackerOne.Report.data.relationships.reporter.data.attributes.signal | Number | The signal of the reporter. This number ranges from -10 to 7. The closer to 7, the higher the average submission quality of the reporter. |
| HackerOne.Report.data.relationships.reporter.data.attributes.impact | Number | The impact of the reporter. This number ranges from 0 to 50. The closer to 50, the higher the average severity of the reporter’s reports is. |
| HackerOne.Report.data.relationships.reporter.data.attributes.website | String | The reporter’s website, as provided by the reporter. |
| HackerOne.Report.data.relationships.reporter.data.attributes.location | String | The reporter’s location, as provided by the reporter. |
| HackerOne.Report.data.relationships.reporter.data.attributes.hackerone_triager | Boolean | Indicates if the reporter is a hackerone triager. |
| HackerOne.Report.data.relationships.program.data.id | String | The unique ID of the program. |
| HackerOne.Report.data.relationships.program.data.type | String | The type of the object of HackerOne. |
| HackerOne.Report.data.relationships.program.data.attributes.handle | String | The handle of the program. |
| HackerOne.Report.data.relationships.program.data.attributes.created_at | String | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.program.data.attributes.updated_at | String | The date and time the object was updated. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.severity.data.id | String | The unique ID of the severity. |
| HackerOne.Report.data.relationships.severity.data.type | String | The type of the severity of HackerOne. |
| HackerOne.Report.data.relationships.severity.data.attributes.rating | String | The qualitative rating of the severity. |
| HackerOne.Report.data.relationships.severity.data.attributes.author_type | String | The involved party that provided the severity. |
| HackerOne.Report.data.relationships.severity.data.attributes.user_id | Number | The unique id of the user who created the object. |
| HackerOne.Report.data.relationships.severity.data.attributes.created_at | String | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.severity.data.attributes.score | Number | The vulnerability score calculated from the Common Vulnerability Scoring System (CVSS). |
| HackerOne.Report.data.relationships.severity.data.attributes.attack_complexity | String | A CVSS metric that describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. |
| HackerOne.Report.data.relationships.severity.data.attributes.attack_vector | String | A CVSS metric that reflects the context by which vulnerability exploitation is possible. |
| HackerOne.Report.data.relationships.severity.data.attributes.availability | String | A CVSS metric that measures the availability of the impacted component resulting from a successfully exploited vulnerability. |
| HackerOne.Report.data.relationships.severity.data.attributes.confidentiality | String | A CVSS metric that measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. |
| HackerOne.Report.data.relationships.severity.data.attributes.integrity | String | A CVSS metric that measures the impact to the integrity of a successfully exploited vulnerability. |
| HackerOne.Report.data.relationships.severity.data.attributes.privileges_required | String | A CVSS metric that describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. |
| HackerOne.Report.data.relationships.severity.data.attributes.user_interaction | String | A CVSS metric that captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerability component. |
| HackerOne.Report.data.relationships.severity.data.attributes.scope | String | A CVSS metric that determines if a successful attack impacts a component other than the vulnerable component. |
| HackerOne.Report.data.relationships.weakness.data.id | String | The unique ID of the weakness. |
| HackerOne.Report.data.relationships.weakness.data.type | String | The type of the object of HackerOne. |
| HackerOne.Report.data.relationships.weakness.data.attributes.name | String | The name of the weakness. |
| HackerOne.Report.data.relationships.weakness.data.attributes.description | String | The raw description of the weakness. |
| HackerOne.Report.data.relationships.weakness.data.attributes.external_id | String | The weakness’ external reference to CWE or CAPEC. |
| HackerOne.Report.data.relationships.weakness.data.attributes.created_at | String | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.custom_field_values.data.id | String | The unique ID of the custom field value. |
| HackerOne.Report.data.relationships.custom_field_values.data.type | String | The type of the object of HackerOne. |
| HackerOne.Report.data.relationships.custom_field_values.data.attributes.value | String | The attribute’s value. |
| HackerOne.Report.data.relationships.custom_field_values.data.attributes.created_at | String | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.custom_field_values.data.attributes.updated_at | String | The date and time the object was updated. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.id | String | The unique ID of the custom field attribute. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.type | String | The type of the object of HackerOne. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.field_type | String | The type of custom field. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.label | String | The attribute’s label. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.internal | Boolean | Internal or public custom field. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.required | Boolean | Whether the field is required or not. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.error_message | String | A custom error message when the regex validation fails. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.helper_text | String | The helper text for custom_field_attribute. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.configuration | String | An optional configuration for the attribute’s type. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.checkbox_text | String | The text shown with a checkbox field. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.regex | String | A regex used to validate the input for a text field. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.created_at | String | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.updated_at | String | The date and time the object was updated. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.custom_field_values.data.relationships.custom_field_attribute.data.attributes.archived_at | String | The date and time the object was archived. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.assignee.data.id | String | The unique ID of the user. |
| HackerOne.Report.data.relationships.assignee.data.type | String | The type of the object of HackerOne. |
| HackerOne.Report.data.relationships.assignee.data.attributes.name | Unknown | The name of the assignee. |
| HackerOne.Report.data.relationships.assignee.data.attributes.created_at | String | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.assignee.data.attributes.permissions | String | The permissions of the group/user. Possible values are reward_management, program_management, user_management, and report_management. |
| HackerOne.Report.data.relationships.assignee.data.attributes.username | String | The username of the assignee. |
| HackerOne.Report.data.relationships.assignee.data.attributes.disabled | Boolean | Indicates if the assignee is disabled. |
| HackerOne.Report.data.relationships.assignee.data.attributes.profile_picture.62x62 | String | URL of the profile photo of the assignee of size 62x62. |
| HackerOne.Report.data.relationships.assignee.data.attributes.profile_picture.82x82 | String | URL of the profile photo of the assignee of size 82x82. |
| HackerOne.Report.data.relationships.assignee.data.attributes.profile_picture.110x110 | String | URL of the profile photo of the assignee of size 110x110. |
| HackerOne.Report.data.relationships.assignee.data.attributes.profile_picture.260x260 | String | URL of the profile photo of the assignee of size 260x260. |
| HackerOne.Report.data.relationships.assignee.data.attributes.signal | Number | The signal of the assignee. The number ranges from -10 to 7. The closer to 7, the higher the average submission quality of the user. |
| HackerOne.Report.data.relationships.assignee.data.attributes.impact | Number | The impact of the assignee. This number ranges from 0 to 50. The closer to 50, the higher the average severity of the user’s reports is. |
| HackerOne.Report.data.relationships.assignee.data.attributes.reputation | Number | The reputation of the assignee. |
| HackerOne.Report.data.relationships.assignee.data.attributes.bio | String | The assignee’s biography, as provided by the assignee. |
| HackerOne.Report.data.relationships.assignee.data.attributes.website | String | The assignee’s website, as provided by the assignee. |
| HackerOne.Report.data.relationships.assignee.data.attributes.location | String | The assignee’s location, as provided by the assignee. |
| HackerOne.Report.data.relationships.assignee.data.attributes.hackerone_triager | Boolean | Indicates if the assignee is a hackerone triager. |
| HackerOne.Report.data.relationships.structured_scope.data.id | String | The unique ID of the scope. |
| HackerOne.Report.data.relationships.structured_scope.data.type | String | The type of the HackerOne object. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.asset_type | String | The type of the asset. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.asset_identifier | String | The identifier of the asset. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.eligible_for_bounty | Boolean | If the asset is eligible for a bounty. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.eligible_for_submission | Boolean | If the asset is eligible for a submission. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.instruction | String | The raw instruction of the asset provided by the program. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.max_severity | String | The qualitative rating of the maximum severity allowed on this asset. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.created_at | Date | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.updated_at | Date | The date and time the object was updated. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.structured_scope.data.attributes.reference | String | The customer defined reference identifier or tag of the asset. |
| HackerOne.Report.data.relationships.bounties.data.id | String | The unique ID of the bounty. |
| HackerOne.Report.data.relationships.bounties.data.type | String | The type of the HackerOne object. |
| HackerOne.Report.data.relationships.bounties.data.attributes.created_at | Date | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Report.data.relationships.bounties.data.attributes.amount | String | Amount in USD. |
| HackerOne.Report.data.relationships.bounties.data.attributes.bonus_amount | String | Bonus amount in USD. |
| HackerOne.Report.data.relationships.bounties.data.attributes.awarded_amount | String | Amount in awarded currency. |
| HackerOne.Report.data.relationships.bounties.data.attributes.awarded_bonus_amount | String | Bonus amount in awarded currency. |
| HackerOne.Report.data.relationships.bounties.data.attributes.awarded_currency | String | The currency used to award the bounty and bonus. |
Command Example
!hackerone-report-list program_handle=something_h1b page_size=2
Context Example
{
"HackerOne": {
"Report": [
{
"attributes": {
"created_at": "2021-08-10T07:17:41.923Z",
"first_program_activity_at": "2021-08-10T07:17:42.048Z",
"last_activity_at": "2021-08-10T07:17:42.048Z",
"last_program_activity_at": "2021-08-10T07:17:42.048Z",
"last_public_activity_at": "2021-08-10T07:17:42.048Z",
"last_reporter_activity_at": "2021-08-10T07:17:42.048Z",
"state": "new",
"title": "Do not use depreciated function isSecure",
"vulnerability_information": "## Summary:\nThe depreciated function isSecure is not compatible with for SSL verification.\n\n## Impact\n\nSSL verification will fail regardless of certificate authenticity."
},
"id": "1297733",
"relationships": {
"custom_field_values": {
"data": [
{
"attributes": {
"created_at": "2021-08-10T07:17:41.929Z",
"updated_at": "2021-08-10T07:17:41.929Z",
"value": "true"
},
"id": "198319",
"relationships": {
"custom_field_attribute": {
"data": {
"attributes": {
"checkbox_text": "Yes",
"created_at": "2021-08-10T07:14:39.477Z",
"field_type": "Checkbox",
"helper_text": "Is the report urgent in need to be resolved?",
"internal": false,
"label": "Urgent",
"required": false,
"updated_at": "2021-08-10T07:14:39.477Z"
},
"id": "1362",
"type": "custom-field-attribute"
}
}
},
"type": "custom-field-value"
}
]
},
"program": {
"data": {
"attributes": {
"created_at": "2021-08-09T13:39:20.342Z",
"handle": "something_h1b",
"updated_at": "2021-08-10T09:29:56.853Z"
},
"id": "53994",
"type": "program"
}
},
"reporter": {
"data": {
"attributes": {
"created_at": "2021-08-02T09:27:56.324Z",
"disabled": false,
"hackerone_triager": false,
"name": "Jahnvi",
"profile_picture": {
"110x110": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png",
"260x260": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png",
"62x62": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png",
"82x82": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png"
},
"username": "jahnvi_crest"
},
"id": "1878386",
"type": "user"
}
},
"severity": {
"data": {
"attributes": {
"attack_complexity": "high",
"attack_vector": "adjacent",
"author_type": "User",
"availability": "none",
"confidentiality": "high",
"created_at": "2021-08-10T07:17:41.970Z",
"integrity": "low",
"privileges_required": "high",
"rating": "medium",
"scope": "changed",
"score": 6.2,
"user_id": 1878386,
"user_interaction": "none"
},
"id": "1185951",
"type": "severity"
}
},
"weakness": {
"data": {
"attributes": {
"created_at": "2017-01-05T01:51:19.000Z",
"description": "The program calls a function that can never be guaranteed to work safely.",
"external_id": "cwe-242",
"name": "Use of Inherently Dangerous Function"
},
"id": "20",
"type": "weakness"
}
}
},
"type": "report"
},
{
"attributes": {
"closed_at": "2021-08-10T07:11:12.110Z",
"created_at": "2021-08-10T07:09:28.496Z",
"first_program_activity_at": "2021-08-10T07:09:28.603Z",
"last_activity_at": "2021-08-17T07:36:10.504Z",
"last_program_activity_at": "2021-08-10T07:11:37.062Z",
"last_public_activity_at": "2021-08-10T07:11:37.062Z",
"last_reporter_activity_at": "2021-08-10T07:11:37.062Z",
"state": "resolved",
"timer_first_program_response_elapsed_time": 103,
"title": "SQL injection vulnerability in user signup form",
"vulnerability_information": "## Summary:\n[add summary of the vulnerability]\n\n## Steps To Reproduce:\n[add details for how we can reproduce the issue]\n\n 1. [add step]\n 1. [add step]\n 1. [add step]\n\n## Supporting Material/References:\n[list any additional material (e.g. screenshots, logs, etc.)]\n\n * [attachment / reference]\n\n## Impact\n\nCan query for all users in db"
},
"id": "1297727",
"relationships": {
"assignee": {
"data": {
"attributes": {
"created_at": "2021-08-09T13:39:21.016Z",
"name": "Standard",
"permissions": [
"report_management",
"reward_management"
]
},
"id": "112937",
"type": "group"
}
},
"program": {
"data": {
"attributes": {
"created_at": "2021-08-09T13:39:20.342Z",
"handle": "something_h1b",
"updated_at": "2021-08-10T09:29:56.853Z"
},
"id": "53994",
"type": "program"
}
},
"reporter": {
"data": {
"attributes": {
"created_at": "2021-08-02T09:27:56.324Z",
"disabled": false,
"hackerone_triager": false,
"name": "Jahnvi",
"profile_picture": {
"110x110": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png",
"260x260": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png",
"62x62": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png",
"82x82": "/assets/avatars/default-71a302d706457f3d3a31eb30fa3e73e6cf0b1d677b8fa218eaeaffd67ae97918.png"
},
"username": "jahnvi_crest"
},
"id": "1878386",
"type": "user"
}
},
"severity": {
"data": {
"attributes": {
"author_type": "User",
"created_at": "2021-08-10T07:09:28.534Z",
"rating": "low",
"user_id": 1878386
},
"id": "1185942",
"type": "severity"
}
},
"weakness": {
"data": {
"attributes": {
"created_at": "2017-01-05T01:51:19.000Z",
"description": "The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.",
"external_id": "cwe-89",
"name": "SQL Injection"
},
"id": "67",
"type": "weakness"
}
}
},
"type": "report"
}
]
}
}
Human Readable Output
Report(s)
Report ID Reporter Username Title State Severity Created At Vulnerability Information 1297733 jahnvi_crest Do not use depreciated function isSecure new medium 2021-08-10T07:17:41.923Z ## Summary:
The depreciated function isSecure is not compatible with for SSL verification.
## Impact
SSL verification will fail regardless of certificate authenticity.1297727 jahnvi_crest SQL injection vulnerability in user signup form resolved low 2021-08-10T07:09:28.496Z ## Summary:
[add summary of the vulnerability]
## Steps To Reproduce:
[add details for how we can reproduce the issue]
1. [add step]
1. [add step]
1. [add step]
## Supporting Material/References:
[list any additional material (e.g. screenshots, logs, etc.)]
* [attachment / reference]
## Impact
Can query for all users in db
hackerone-program-list
Retrieves information about the programs in which the user is a member.
Base Command
hackerone-program-list
Input
| Argument Name | Description | Required |
|---|---|---|
| page_size | The number of programs to retrieve per page. Default value is 50. Note: Possible values are between 1 and 100. |
Optional |
| page_number | Page number to retrieve the programs from the specified page. Default value is 1. | Optional |
| limit | Number of programs to retrieve. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| HackerOne.Program.id | String | The unique ID of the program. |
| HackerOne.Program.type | String | The type of the object of HackerOne. |
| HackerOne.Program.attributes.handle | String | The handle of the program. |
| HackerOne.Program.attributes.policy | String | The policy of the program. |
| HackerOne.Program.attributes.created_at | Date | The date and time the object was created. Formatted according to ISO 8601. |
| HackerOne.Program.attributes.updated_at | Date | The date and time the object was updated. Formatted according to ISO 8601. |
Command Example
!hackerone-program-list page_size=2
Context Example
{
"HackerOne": {
"Program": [
{
"attributes": {
"created_at": "2021-08-09T13:39:20.342Z",
"handle": "something_h1b",
"policy": "# What we are looking for\r\nWe want to proactively discover and remediate security vulnerabilities on our digital assets\r\n\r\nThe vulnerabilities identified in the HackerOne reports will be classified by the degree of risk as well as the impact they present to the host system, this includes the amount and type of data exposed, privilege level obtained, the proportion of systems or users affected.\r\n\r\n# What is a Bug Bounty Program?\r\nsomething\u2019s Bug Bounty Program (BBP) is an initiative driven and managed by the something Information Security team. \r\n\r\n* Security researchers are encouraged to report any behavior impacting the information security posture of something\u2019 products and services. If you are performing research, please use your own accounts and do not interact with other people\u2019s accounts or data.\r\n* Document your findings thoroughly, providing steps to reproduce and send your report to us. Reports with complete vulnerability details, including screenshots or video, are essential for a quick response. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\r\n *Reference HackerOne guidance on writing quality reports:\r\n * https://docs.hackerone.com/hackers/quality-reports.html \r\n * https://www.hacker101.com/sessions/good_reports\r\n\r\n* We will contact you to confirm that we\u2019ve received your report and trace your steps to reproduce your research.\r\n* We will work with the affected teams to validate the report.\r\n* We will issue bounty awards for eligible findings. To be eligible for rewards, reports must comply with all parts of this policy and you must be the first to report the issue to us. You must be 18 or older to be eligible for an award.\r\n* We will notify you of remediation and may reach out for questions or clarification. You must be available to provide additional information if needed by us to reproduce and investigate the report.\r\n\r\n\r\n# Response Targets\r\nWe will make a best effort to meet the following response targets for hackers participating in our program:\r\n\r\n* Time to first response (from report submit) - 1 business days\r\n* Time to triage (from report submit) - 2 business days \r\n* Time to bounty (from triage) - 10 business days\r\n\r\nWe\u2019ll try to keep you informed about our progress throughout the process.\r\n\r\n# Program Rules\r\n* Do not try to further pivot into the network by using a vulnerability. The rules around Remote Code Execution (RCE), SQL Injection (SQLi), and FileUpload vulnerabilities are listed below.\r\n* Do not try to exploit service providers we use, prohibited actions include, but are not limited to bruteforcing login credentials of Domain Registrars, DNS Hosting Companies, Email Providers and/or others. The Firm does not authorize you to perform any actions to any property/system/service/data not listed below.\r\n* If you encounter Personally Identifiable Information (PII) contact us immediately. Do not proceed with access and immediately purge any local information, if applicable.\r\n* Please limit any automated scanning to 60 requests per second. Aggressive testing that causes service degradation will be grounds for removal from the program.\r\n\r\n* Submit one vulnerability per- report, unless you need to chain vulnerabilities to provide impact.\r\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\r\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.\r\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\r\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.\r\n\r\n# Disclosure Policy\r\n* As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\r\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\r\n\r\n\r\n# How To Create Accounts\r\n* Go to our Website\r\n* Register \r\n* use @hackerone.com email address\r\n* Only use accounts you're authorised to access\r\n\r\n# Rewards\r\nOur rewards are based on severity per the Common Vulnerability Scoring Standard (CVSS). Please note these are general guidelines, and that reward decisions are up to the discretion of something.\r\n\r\n#Out of scope vulnerabilities\r\n\r\n\r\n***Note: 0-day vulnerabilities may be reported 30 days after initial publication. We have a team dedicated to tracking these issues; hosts identified by this team and internally ticketed will not be eligible for bounty.***\r\n\r\nThe following issues are considered out of scope:\r\n \r\n When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\r\n\r\n* Disruption of our service (DoS, DDoS).\r\n* PII - do not collect any personally identifiable information - including credit card information, addresses and phone numbers from other customers\r\n* Reports from automated tools or scans\r\n* Social engineering of employees or contractors\r\n* For the time being we are making all vulnerabilities in Flash files out of scope\r\n* Reports affecting outdated browsers\r\n* Known vulnerabilities on deprecated assets not currently covered by CloudFlare.\r\n* Missing security best practices and controls (rate-limiting/throttling, lack of CSRF protection, lack of security headers, missing flags on cookies, descriptive errors, server/technology disclosure - without clear and working exploit)\r\n* Lack of crossdomain.xml, p3p.xml, robots.txt or any other policy files and/or wildcard presence/misconfigurations in these\r\n* Use of a known-vulnerable libraries or frameworks - for example an outdated JQuery or AngularJS (without clear and working exploit)\r\n* Self-exploitation (cookie reuse, self cookie-bomb, self denial-of-service etc.)\r\n* Self Cross-site Scripting vulnerabilities without evidence on how the vulnerability can be used to attack another user\r\n* Lack of HTTPS\r\n* Reports about insecure SSL / TLS configuration\r\n* Password complexityrequirements, account/email enumeration, or any report that discusses how you can learn whether a given username or email address is easy to guess\r\n* Presence/Lack of autocomplete attribute on web forms/password managers\r\n* Server Banner Disclosure/Technology used Disclosure\r\n* Full Path Disclosure\r\n* IP Address Disclosure\r\n* CSRF on logout or insignificant functionalities\r\n* Publicly accessible login panels\r\n* Clickjacking\r\n* CSS Injection attacks (Unless it gives you ability to read anti-CSRF tokens or other sensitive information)\r\n* Tabnabbing\r\n* Host Header Injection (Unless it givesyou access to interim proxies)\r\n* Cache Poisoning\r\n* Reflective File Download\r\n* Cookie scoped to parent domain or anything related to the path misconfiguration and improperly scoped\r\n* Private IP/Hostname disclosures or real IP disclosures for services using CDN\r\n* Open ports which do not lead directly to a vulnerability\r\n* Weak Certificate Hash Algorithm\r\n* Any physical/wireless attempt against our property or data centers\r\n\r\n# Safe Harbor \r\nThis policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause us to be in breach of any of its legal obligations, including but not limited to:\r\n\r\n* The General Data Protection Regulation 2016/679 (GDPR) andthe Data Protection Act 2018\r\n\r\nWe affirm that we will not seek prosecution of any security researcher who reports any security vulnerability on a service or system, where the researcher has acted in good faith and in accordance with this disclosure policy.\r\n\r\nsomething cannot authorize any activity on third-party products or guarantee they won\u2019t pursue legal action against you. We aren\u2019t responsible for your liability from actions performed on third parties.\r\n\r\nThank you for helping keep us and our users safe!\r\n\n",
"updated_at": "2021-08-10T09:29:56.853Z"
},
"id": "53994",
"type": "program"
},
{
"attributes": {
"created_at": "2021-08-09T13:41:35.764Z",
"handle": "checker_program_h1b",
"policy": "# What we are looking for\r\nWe want to proactively discover and remediate security vulnerabilities on our digital assets\r\n\r\nThe vulnerabilities identified in the HackerOne reports will be classified by the degree of risk as well as the impact they present to the host system, this includes the amount and type of data exposed, privilege level obtained, the proportion of systems or users affected.\r\n\r\n# What is a Bug Bounty Program?\r\nchecker_program\u2019s Bug Bounty Program (BBP) is an initiative driven and managed by the checker_program Information Security team. \r\n\r\n* Security researchers are encouraged to report any behavior impacting the information security posture of checker_program\u2019 products and services. If you are performing research, please use your own accounts and do not interact with other people\u2019s accounts or data.\r\n* Document your findings thoroughly, providing steps to reproduce and send your report to us. Reports with complete vulnerability details, including screenshots or video, are essential for a quick response. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.\r\n *Reference HackerOne guidance on writing quality reports:\r\n * https://docs.hackerone.com/hackers/quality-reports.html \r\n * https://www.hacker101.com/sessions/good_reports\r\n\r\n* We will contact you to confirm that we\u2019ve received your report and trace your steps to reproduce your research.\r\n* We will work with the affected teams to validate the report.\r\n* We will issue bounty awards for eligible findings. To be eligible for rewards, reports must comply with all parts of this policy and you must be the first to report the issue to us. You must be 18 or older to be eligible for an award.\r\n* We will notify you of remediation and may reach out for questions or clarification. You must be available to provide additional information if needed by us to reproduce and investigate the report.\r\n\r\n\r\n# Response Targets\r\nWe will make a best effort to meet the following response targets for hackers participating in our program:\r\n\r\n* Time to first response (from report submit) - 1 business days\r\n* Time to triage (from report submit) - 2 business days \r\n* Time to bounty (from triage) - 10 business days\r\n\r\nWe\u2019ll try to keep you informed about our progress throughout the process.\r\n\r\n# Program Rules\r\n* Do not try to further pivot into the network by using a vulnerability. The rules around Remote Code Execution (RCE), SQL Injection (SQLi), and FileUpload vulnerabilities are listed below.\r\n* Do not try to exploit service providers we use, prohibited actions include, but are not limited to bruteforcing login credentials of Domain Registrars, DNS Hosting Companies, Email Providers and/or others. The Firm does not authorize you to perform any actions to any property/system/service/data not listed below.\r\n* If you encounter Personally Identifiable Information (PII) contact us immediately. Do not proceed with access and immediately purge any local information, if applicable.\r\n* Please limit any automated scanning to 60 requests per second. Aggressive testing that causes service degradation will be grounds for removal from the program.\r\n\r\n* Submit one vulnerability per- report, unless you need to chain vulnerabilities to provide impact.\r\n* When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).\r\n* Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.\r\n* Social engineering (e.g. phishing, vishing, smishing) is prohibited.\r\n* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.\r\n\r\n# Disclosure Policy\r\n* As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.\r\n* Follow HackerOne's [disclosure guidelines](https://www.hackerone.com/disclosure-guidelines).\r\n\r\n\r\n# How To Create Accounts\r\n* Go to our Website\r\n* Register \r\n* use @hackerone.com email address\r\n* Only use accounts you're authorised to access\r\n\r\n# Rewards\r\nOur rewards are based on severity per the Common Vulnerability Scoring Standard (CVSS). Please note these are general guidelines, and that reward decisions are up to the discretion of checker_program.\r\n\r\n#Out of scope vulnerabilities\r\n\r\n\r\n***Note: 0-day vulnerabilities may be reported 30 days after initial publication. We have a team dedicated to tracking these issues; hosts identified by this team and internally ticketed will not be eligible for bounty.***\r\n\r\nThe following issues are considered out of scope:\r\n \r\n When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:\r\n\r\n* Disruption of our service (DoS, DDoS).\r\n* PII - do not collect any personally identifiable information - including credit card information, addresses and phone numbers from other customers\r\n* Reports from automated tools or scans\r\n* Social engineering of employees or contractors\r\n* For the time being we are making all vulnerabilities in Flash files out of scope\r\n* Reports affecting outdated browsers\r\n* Known vulnerabilities on deprecated assets not currently covered by CloudFlare.\r\n* Missing security best practices and controls (rate-limiting/throttling, lack of CSRF protection, lack of security headers, missing flags on cookies, descriptive errors, server/technology disclosure - without clear and working exploit)\r\n* Lack of crossdomain.xml, p3p.xml, robots.txt or any other policy files and/or wildcard presence/misconfigurations in these\r\n* Use of a known-vulnerable libraries or frameworks - for example an outdated JQuery or AngularJS (without clear and working exploit)\r\n* Self-exploitation (cookie reuse, self cookie-bomb, self denial-of-service etc.)\r\n* Self Cross-site Scripting vulnerabilities without evidence on how the vulnerability can be used to attack another user\r\n* Lack of HTTPS\r\n* Reports about insecure SSL / TLS configuration\r\n* Password complexityrequirements, account/email enumeration, or any report that discusses how you can learn whether a given username or email address is easy to guess\r\n* Presence/Lack of autocomplete attribute on web forms/password managers\r\n* Server Banner Disclosure/Technology used Disclosure\r\n* Full Path Disclosure\r\n* IP Address Disclosure\r\n* CSRF on logout or insignificant functionalities\r\n* Publicly accessible login panels\r\n* Clickjacking\r\n* CSS Injection attacks (Unless it gives you ability to read anti-CSRF tokens or other sensitive information)\r\n* Tabnabbing\r\n* Host Header Injection (Unless it givesyou access to interim proxies)\r\n* Cache Poisoning\r\n* Reflective File Download\r\n* Cookie scoped to parent domain or anything related to the path misconfiguration and improperly scoped\r\n* Private IP/Hostname disclosures or real IP disclosures for services using CDN\r\n* Open ports which do not lead directly to a vulnerability\r\n* Weak Certificate Hash Algorithm\r\n* Any physical/wireless attempt against our property or data centers\r\n\r\n# Safe Harbor \r\nThis policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause us to be in breach of any of its legal obligations, including but not limited to:\r\n\r\n* The General Data Protection Regulation 2016/679 (GDPR) andthe Data Protection Act 2018\r\n\r\nWe affirm that we will not seek prosecution of any security researcher who reports any security vulnerability on a service or system, where the researcher has acted in good faith and in accordance with this disclosure policy.\r\n\r\nchecker_program cannot authorize any activity on third-party products or guarantee they won\u2019t pursue legal action against you. We aren\u2019t responsible for your liability from actions performed on third parties.\r\n\r\nThank you for helping keep us and our users safe!\r\n\r\n",
"updated_at": "2021-08-10T09:29:56.984Z"
},
"id": "53996",
"type": "program"
}
]
}
}
Human Readable Output
Program(s)
Program ID Handle Created At Updated At 53994 something_h1b 2021-08-09T13:39:20.342Z 2021-08-10T09:29:56.853Z 53996 checker_program_h1b 2021-08-09T13:41:35.764Z 2021-08-10T09:29:56.984Z
Configuration parameters
url— Server URL (required)username— Username (required)max_fetch— Maximum number of incidents per fetchfirst_fetch— First fetch time intervalprogram_handle— Program Handlestate— Stateseverity— Severityfilter_by— Advanced Filtersproxy— Use system proxy settingsinsecure— Trust any certificate (not secure)incidentType— Incident typeincidentFetchInterval— Incidents Fetch IntervalisFetch— Fetch incidents
Commands (2)
-
hackerone-program-listRetrieves information about the programs in which the user is a member.
-
hackerone-report-listRetrieves all the reports based on program handle and provided arguments.
import json import os from unittest import mock import pytest from CommonServerPython import DemistoException from test_data import input_data BASE_URL = "https://mocked_url/v1/" URL_SUFFIX = {"REPORTS": "reports", "PROGRAMS": "me/programs"} def util_load_json(path): with open(path, encoding="utf-8") as f: return json.loads(f.read()) @pytest.fixture() def client(): from HackerOne import Client return Client( "https://mocked_url/v1", False, False, auth=("user", "user123"), max_fetch=1, first_fetch="2020-09-07T04:59:51Z", program_handle=["checker_program_h1b"], severity="", state="", filters="", ) def test_test_module_when_valid_response_is_returned(client, requests_mock): """ Test test_module function for success cases. Given - A valid response When - The status code returned is 200 Then - Ensure test module should return success """ from HackerOne import test_module requests_mock.get(BASE_URL + URL_SUFFIX["PROGRAMS"], status_code=200, json="{}") assert test_module(client) == "ok" def test_test_module_when_isfetch_is_true(requests_mock, client): """ Test test_module function when isFetch is True. Given - A valid response When - The status code returned is 200 and is_fetch is true Then - Ensure test module should return success """ from HackerOne import test_module requests_mock.get(BASE_URL + URL_SUFFIX["PROGRAMS"], json={"page_size": 1}, status_code=200) requests_mock.get(BASE_URL + URL_SUFFIX["REPORTS"], json={"filter[program][]": ["abc"]}, status_code=200) assert test_module(client) == "ok" def test_test_module_when_authentication_error_is_returned(requests_mock, client): """ Test test_module function for failure cases. Given - an error status code When - the user can't be authenticated Then - raise DemistoException """ from HackerOne import test_module requests_mock.get(BASE_URL + URL_SUFFIX["PROGRAMS"], status_code=400, json={}) with pytest.raises(DemistoException): test_module(client) @pytest.mark.parametrize("status_code, error_msg, expected_error_message", input_data.exception_handler_params) def test_exception_handler_json(status_code, error_msg, expected_error_message, client): """ To test exception handler in various http error code. Given - a dictionary containing http error code. When - initializing client. Then - raise DemistoException """ mocked_response = mock.Mock() mocked_response.status_code = status_code mocked_response.json.return_value = error_msg mocked_response.headers = {"Content-Type": "application/json"} with pytest.raises(DemistoException) as err: client.exception_handler(mocked_response) assert str(err.value) == expected_error_message def test_exception_handler_not_json(client): """ To test exception handler in various http error code. Given - 423 error code When - initializing client. Then - raise DemistoException """ status_code = 423 error_msg = ( "<html>\n<head><title>423 Invalid</title></head>\n<body>\n<center><h1>423 Invalid</h1></center>" "\n<hr><center>nginx</center>\n</body>\n</html>" ) expected_error_message = "Unable to retrieve the data based on arguments." mocked_response = mock.Mock() mocked_response.status_code = status_code mocked_response.json.return_value = error_msg mocked_response.headers = {"Content-Type": "text/html"} with pytest.raises(DemistoException) as err: client.exception_handler(mocked_response) assert str(err.value) == expected_error_message def test_hackerone_program_list_command_when_valid_response_is_returned(client, requests_mock): """ Test case scenario for successful execution of hackerone-program-list command. Given: - command arguments for list program command When: - Calling `hackerone-program-list` command Then: - Returns the response data """ from HackerOne import hackerone_program_list_command response = util_load_json(os.path.join("test_data", "program/program_command_response.json")) requests_mock.get(BASE_URL + URL_SUFFIX["PROGRAMS"], json=response, status_code=200) context_output = util_load_json(os.path.join("test_data", "program/program_command_context.json")) with open(os.path.join("test_data", "program/program_command_readable_output.md")) as f: readable_output = f.read() # Execute command_response = hackerone_program_list_command(client, {}) # Assert assert command_response.outputs_prefix == "HackerOne.Program" assert command_response.outputs_key_field == "id" assert command_response.outputs == context_output assert command_response.readable_output == readable_output def test_hackerone_program_list_command_when_empty_response_is_returned(client, requests_mock): """ Test case scenario for successful execution of hackerone-program-list command with an empty response. Given: - command arguments for list program command When: - Calling `hackerone-program-list` command Then: - Returns no records for the given input arguments """ from HackerOne import hackerone_program_list_command expected_response = {"data": [], "links": []} requests_mock.get(BASE_URL + URL_SUFFIX["PROGRAMS"], status_code=200, json=expected_response) readable_output = "No programs were found for the given argument(s)." # Execute command_response = hackerone_program_list_command(client, {}) # Assert assert command_response.readable_output == readable_output @pytest.mark.parametrize("args, expected_error", input_data.invalid_args_for_program_list) def test_hackerone_program_list_command_when_invalid_args_provided(client, args, expected_error): """ Test case scenario when invalid arguments are provided. Given: - invalid command arguments for list program command When - Calling `hackerone-program-list` Then: - Returns the response message of invalid input arguments """ from HackerOne import hackerone_program_list_command with pytest.raises(ValueError) as err: hackerone_program_list_command(client, args) assert str(err.value) == expected_error @pytest.mark.parametrize("args, expected_params", input_data.report_list_args) def test_validate_report_list_args_when_valid_args_are_provided(args, expected_params): """ Test case scenario when report list valid arguments are provided. Given: - valid command arguments for list report command When - Calling `prepare_report_list_args` Then: - Returns the expected params. """ from HackerOne import prepare_report_list_args assert prepare_report_list_args(args) == expected_params def test_hackerone_report_list_command_when_empty_response_is_returned(client, requests_mock): """ Test case scenario for successful execution of hackerone-report-list command with an empty response. Given: - command arguments for list report command When: - Calling `hackerone-report-list` command Then: - Returns no records for the given input arguments """ from HackerOne import hackerone_report_list_command expected_response = {"data": [], "links": []} requests_mock.get(BASE_URL + URL_SUFFIX["REPORTS"], json=expected_response, status_code=200) readable_output = "No reports were found for the given argument(s)." # Execute command_response = hackerone_report_list_command(client, {"program_handle": "abc"}) # Assert assert command_response.readable_output == readable_output def test_hackerone_report_list_command_when_valid_response_is_returned(client, requests_mock): """ Test case scenario for successful execution of hackerone-report-list command. Given: - command arguments for list report command When: - Calling `hackerone-report-list` command Then: - Returns the response data """ from HackerOne import hackerone_report_list_command response = util_load_json(os.path.join("test_data", "report/report_command_response.json")) requests_mock.get(BASE_URL + URL_SUFFIX["REPORTS"], json=response, status_code=200) context_output = util_load_json(os.path.join("test_data", "report/report_command_context.json")) with open(os.path.join("test_data", "report/report_command_readable_output.md")) as f: readable_output = f.read() # Execute command_response = hackerone_report_list_command(client, {"program_handle": "abc"}) # Assert assert command_response.outputs_prefix == "HackerOne.Report" assert command_response.outputs_key_field == "id" assert command_response.outputs == context_output assert command_response.readable_output == readable_output @pytest.mark.parametrize("args, expected_error", input_data.invalid_args_for_report_list) def test_hackerone_report_list_command_when_invalid_args_provided(client, args, expected_error): """ Test case scenario when invalid arguments for report list command are provided. Given: - invalid command arguments for list report command When - Calling `hackerone-report-list` Then: - Returns the response message of invalid input arguments """ from HackerOne import hackerone_report_list_command with pytest.raises(ValueError) as err: hackerone_report_list_command(client, args) assert str(err.value) == expected_error def test_fetch_incident_when_empty_result_is_returned(client, requests_mock): """ test case scenario when the results are empty. Given: - Fetch incident parameters When: - Fetching incidents. Then: - Returns empty response for first time """ from HackerOne import fetch_incidents last_run = {"current_created_at": "2020-09-07T04:59:51", "next_page": 2} expected_response = {"data": [], "links": []} requests_mock.get(BASE_URL + URL_SUFFIX["REPORTS"], json=expected_response, status_code=200) fetched_incidents = fetch_incidents(client, last_run) expected_next_run = {"current_created_at": "2020-09-07T04:59:51", "next_page": 2} assert fetched_incidents == (expected_next_run, []) def test_fetch_incident_when_valid_result_is_returned(client, requests_mock): """ test case scenario when the results are valid on fetching for the first time. Given: - Fetch incident parameters When: - Fetching incidents. Then: - Ensure that the incidents returned are as expected. """ from HackerOne import fetch_incidents last_run = {} incident_data = util_load_json(os.path.join("test_data", "incident/raw_response.json")) requests_mock.get(BASE_URL + URL_SUFFIX["REPORTS"], json=incident_data, status_code=200) fetched_incidents = fetch_incidents(client, last_run) next_run = {"next_created_at": "2021-08-09T13:41:38.039Z", "report_ids": ["1295856"]} incidents = [ { "name": incident_data.get("data")[0].get("attributes").get("title"), "occurred": incident_data.get("data")[0].get("attributes").get("created_at"), "rawJSON": json.dumps(incident_data.get("data")[0]), } ] assert fetched_incidents == (next_run, incidents) def test_fetch_incident_when_getting_already_fetched_report(client, requests_mock): """ test case scenario when the results are valid on fetching for the first time. Given: - Fetch incident parameters When: - Fetching incidents. Then: - Ensure that these reports are already fetched previously. """ from HackerOne import fetch_incidents incident_data = util_load_json(os.path.join("test_data", "incident/raw_response.json")) last_run = {"next_created_at": "2021-08-09T13:41:38.039Z", "report_ids": ["1295856"]} requests_mock.get(BASE_URL + URL_SUFFIX["REPORTS"], json=incident_data, status_code=200) fetched_incidents = fetch_incidents(client, last_run) next_run = {"next_created_at": "2021-08-09T13:41:38.039Z", "report_ids": ["1295856"]} assert fetched_incidents == (next_run, []) def test_fetch_incident_when_report_ids_should_be_replaced(client, requests_mock): """ Test case scenario when report ids are replaced Given: - Fetch incident parameters When: - Fetching incidents. Then: - Ensure that the report ids are replaced. """ from HackerOne import fetch_incidents incident_data = util_load_json(os.path.join("test_data", "incident/raw_response.json")) last_run = {"next_created_at": "2020-09-07T04:59:51Z", "report_ids": ["1295852"]} requests_mock.get(BASE_URL + URL_SUFFIX["REPORTS"], json=incident_data, status_code=200) fetched_incidents = fetch_incidents(client, last_run) next_run = {"next_created_at": "2021-08-09T13:41:38.039Z", "report_ids": ["1295856"]} incidents = [ { "name": incident_data.get("data")[0].get("attributes").get("title"), "occurred": incident_data.get("data")[0].get("attributes").get("created_at"), "rawJSON": json.dumps(incident_data.get("data")[0]), } ] assert fetched_incidents == (next_run, incidents) @pytest.mark.parametrize( "max_fetch, first_fetch, program_handle, severity, state, filters, page, expected_params", input_data.valid_params_for_fetch_incidents, ) def test_fetch_incident_when_valid_params_are_provided( max_fetch, first_fetch, program_handle, severity, state, filters, page, expected_params ): """ test case scenario when valid parameters are provided for fetching the incidents. Given: - Valid fetch incident parameters When: - Fetching incidents. Then: - Prepare params to fetch incidents """ from HackerOne import prepare_fetch_incidents_parameters assert ( prepare_fetch_incidents_parameters(max_fetch, first_fetch, program_handle, severity, state, filters, page) == expected_params ) @pytest.mark.parametrize("max_fetch, program_handle,filters, expected_error_msg", input_data.invalid_params_for_fetch_incidents) def test_fetch_incident_when_invalid_params_are_provided(max_fetch, program_handle, filters, expected_error_msg): """ test case scenario when invalid parameters are provided for fetching the incidents. Given: - Invalid fetch incident parameters When: - Fetching incidents. Then: - Returns error for invalid arguments """ from HackerOne import validate_fetch_incidents_parameters with pytest.raises(ValueError) as err: validate_fetch_incidents_parameters(max_fetch, program_handle, filters) assert str(err.value) == expected_error_msg