Use this tool to fetch public/private scopes from bug bounty programs and output them in various formats.

Installation

go install github.com/root4loot/rescope/cmd/rescope@latest

Docker

git clone https://github.com/root4loot/rescope.git
cd rescope
docker run --rm -it $(docker build -q .) [options] [<BugBountyURL>...]

Usage

Usage:
 rescope [options] [<BugBountyURL>...] [-iL <file>] [-eL <file>]
INPUT:
 -iL, --include-list file containing list of URLs or custom in-scope definitions (newline separated)
 -eL, --exclude-list file containing list of URLs or custom out-of-scope definitions (newline separated)
OUTPUT:
 -oF, --output-file output to given file (default: stdout)
OUTPUT FORMAT:
 -oT, --output-text output simple text (default)
 -oB, --output-burp output Burp Suite Scope (JSON)
 -oZ, --output-zap output ZAP Scope (XML)
 -oJ, --output-json output JSON
 -oJL, --output-json-lines output JSON lines
OUTPUT FILTER:
 --filter-expand-ip-ranges output individual IPs instead of IP ranges / CIDRs
AUTHORIZATION:
 --auth-bugcrowd bugcrowd secret (_bugcrowd_session=cookie.value) [Optional]
 --auth-hackerone hackerone secret (Authorization bearer token) [Optional]
 --auth-yeswehack yeswehack secret (Authorization bearer token) [Optional]
 --auth-intigriti intigriti secret (see https://app.intigriti.com/researcher/personal-access-tokens) [Optional]
GENERAL:
 -c, --concurrency maximum number of concurrent requests (default: 5)
 --proxy proxy to use for requests (e.g. 127.0.0.1:8080)
 --debug enable debug mode
 --version display version

Example Usage

rescope https://hackerone.com/security https://bugcrowd.com/tesla

rescope --output-burp --output-file burp_scope.json https://hackerone.com/security https://bugcrowd.com/tesla

Custom Include and Exclude Lists

Example include.txt:

*.example.com
api.example.com
192.168.1.0/24
10.0.0.1
10.0.0.1:8080

Example exclude.txt:

test.example.com
192.168.1.100

rescope -iL include.txt -eL exclude.txt

cat urls.txt | rescope

As a library

package main
import (
	"fmt"
	"log"
	"github.com/root4loot/rescope/pkg/rescope"
)
func main() {
	opts := rescope.DefaultOptions()
	opts.AuthHackerOne = "your_hackerone_token" // Optional
	opts.AuthIntigriti = "your_intigriti_token" // Optional
	bugBountyURLs := []string{
		"https://hackerone.com/security",
		"https://bugcrowd.com/tesla",
	}
	for _, url := range bugBountyURLs {
		result, err := rescope.Run(url, opts)
		if err != nil {
			log.Printf("Failed to run rescope for URL %s: %v", url, err)
			continue
		}
		fmt.Printf("Results for %s:\n", url)
		fmt.Printf("In-Scope: %v\n", result.InScope)
		fmt.Printf("Out-Scope: %v\n", result.OutScope)
	}
}

Importing to Burp Suite and OWASP ZAP

Burp Suite

OWASP ZAP

Contributing