Hackerone Hacktivity on your terminal

hackerone-hacktivity-graphl.sh

#/bin/bash

json=$(curl -s 'https://hackerone.com/graphql' \
  -H 'authority: hackerone.com' \
  -H 'accept: */*' \
  -H 'x-auth-token: ----' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.101 Safari/537.36' \
  -H 'content-type: application/json' \
  -H 'sec-gpc: 1' \
  -H 'origin: https://hackerone.com' \
  -H 'sec-fetch-site: same-origin' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-dest: empty' \
  -H 'referer: https://hackerone.com/hacktivity?querystring=&filter=type:public&order_direction=DESC&order_field=latest_disclosable_activity_at&followed_only=false' \
  -H 'accept-language: en-US,en;q=0.9' \
  --data-binary '{"operationName":"HacktivityPageQuery","variables":{"querystring":"","where":{"report":{"disclosed_at":{"_is_null":false}}},"orderBy":null,"secureOrderBy":{"latest_disclosable_activity_at":{"_direction":"DESC"}},"count":25},"query":"query HacktivityPageQuery($querystring: String, $orderBy: HacktivityItemOrderInput, $secureOrderBy: FiltersHacktivityItemFilterOrder, $where: FiltersHacktivityItemFilterInput, $count: Int, $cursor: String) {\n  me {\n    id\n    __typename\n  }\n  hacktivity_items(first: $count, after: $cursor, query: $querystring, order_by: $orderBy, secure_order_by: $secureOrderBy, where: $where) {\n    total_count\n    ...HacktivityList\n    __typename\n  }\n}\n\nfragment HacktivityList on HacktivityItemConnection {\n  total_count\n  pageInfo {\n    endCursor\n    hasNextPage\n    __typename\n  }\n  edges {\n    node {\n      ... on HacktivityItemInterface {\n        id\n        databaseId: _id\n        ...HacktivityItem\n        __typename\n      }\n      __typename\n    }\n    __typename\n  }\n  __typename\n}\n\nfragment HacktivityItem on HacktivityItemUnion {\n  type: __typename\n  ... on HacktivityItemInterface {\n    id\n    votes {\n      total_count\n      __typename\n    }\n    upvoted: upvoted_by_current_user\n    __typename\n  }\n  ... on Undisclosed {\n    id\n    ...HacktivityItemUndisclosed\n    __typename\n  }\n  ... on Disclosed {\n    id\n    ...HacktivityItemDisclosed\n    __typename\n  }\n  ... on HackerPublished {\n    id\n    ...HacktivityItemHackerPublished\n    __typename\n  }\n}\n\nfragment HacktivityItemUndisclosed on Undisclosed {\n  id\n  reporter {\n    id\n    username\n    ...UserLinkWithMiniProfile\n    __typename\n  }\n  team {\n    handle\n    name\n    medium_profile_picture: profile_picture(size: medium)\n    url\n    id\n    ...TeamLinkWithMiniProfile\n    __typename\n  }\n  latest_disclosable_action\n  latest_disclosable_activity_at\n  requires_view_privilege\n  total_awarded_amount\n  currency\n  __typename\n}\n\nfragment TeamLinkWithMiniProfile on Team {\n  id\n  handle\n  name\n  __typename\n}\n\nfragment UserLinkWithMiniProfile on User {\n  id\n  username\n  __typename\n}\n\nfragment HacktivityItemDisclosed on Disclosed {\n  id\n  reporter {\n    id\n    username\n    ...UserLinkWithMiniProfile\n    __typename\n  }\n  team {\n    handle\n    name\n    medium_profile_picture: profile_picture(size: medium)\n    url\n    id\n    ...TeamLinkWithMiniProfile\n    __typename\n  }\n  report {\n    id\n    title\n    substate\n    url\n    __typename\n  }\n  latest_disclosable_action\n  latest_disclosable_activity_at\n  total_awarded_amount\n  severity_rating\n  currency\n  __typename\n}\n\nfragment HacktivityItemHackerPublished on HackerPublished {\n  id\n  reporter {\n    id\n    username\n    ...UserLinkWithMiniProfile\n    __typename\n  }\n  team {\n    id\n    handle\n    name\n    medium_profile_picture: profile_picture(size: medium)\n    url\n    ...TeamLinkWithMiniProfile\n    __typename\n  }\n  report {\n    id\n    url\n    title\n    substate\n    __typename\n  }\n  latest_disclosable_activity_at\n  severity_rating\n  __typename\n}\n"}' \
  --compressed)

echo -e $json |
  jq -crM '.data .hacktivity_items .edges[] | .node | "\(.team.handle), \(.severity_rating), \(.report.title),\(.report.url), @\(.reporter.username), \(.total_awarded_amount),"' |
  column -t -s ','

OUTPUT

nodejs-ecosystem   critical   [curling] Remote Code Execution                                                                                    https://hackerone.com/reports/973386    @solov9ev      null
nodejs-ecosystem   critical   [imagickal] Remote Code Execution                                                                                  https://hackerone.com/reports/973245    @solov9ev      null
nodejs-ecosystem   critical   [arpping] Remote Code Execution                                                                                    https://hackerone.com/reports/972220    @solov9ev      null
nodejs-ecosystem   medium     [dy-server2] - stored Cross-Site Scripting                                                                         https://hackerone.com/reports/796487    @saddeann      null
stripo             medium     Bypass of #1047119: Missing Rate Limit while creating Plug-Ins at https://my.stripo.email/cabinet/plugins/         https://hackerone.com/reports/1076047   @savxiety      null
h1-ctf             null       ctf walkthrough                                                                                                    https://hackerone.com/reports/1065468   @rekter0       null
deptofdefense      high       SQL Injection in www.██████████                                                                                    https://hackerone.com/reports/1015406   @val_brux      null
deptofdefense      medium     PII Information Leak at https://████████.mil/                                                                      https://hackerone.com/reports/1057269   @savxiety      null
deptofdefense      critical   Authentication bypass and RCE on the https://████ due to exposed Cisco TelePresence SX80 with default credentials  https://hackerone.com/reports/684070    @sp1d3rs       null
deptofdefense      critical   Directory Indexing on the ████ (https://████/) leads to the backups disclosure and credentials leak                https://hackerone.com/reports/684838    @sp1d3rs       null
deptofdefense      high       Local File Disclosure on the ████████ (https://████/) leads to the source code disclosure & DB credentials leak    https://hackerone.com/reports/685344    @sp1d3rs       null
deptofdefense      medium     System Error Reveals Sensitive SQL Call Data                                                                       https://hackerone.com/reports/1020472   @pi_hunter50   null
deptofdefense      critical   Apache solr RCE via velocity template                                                                              https://hackerone.com/reports/822002    @khizer47      null
deptofdefense      medium     Sensitive data exposure via https://███████/secure/QueryComponent!Default.jspa - CVE-2020-14179                    https://hackerone.com/reports/1067004   @elpast        null
deptofdefense      medium     Sensitive data exposure via https://███/secure/QueryComponent!Default.jspa - CVE-2020-14179                        https://hackerone.com/reports/1050454   @elpast        null
deptofdefense      high       SSRF in login page using fetch API exposes victims IP address to attacker controled server                         https://hackerone.com/reports/996273    @r0p0          null
deptofdefense      medium     POST based RXSS on https://█████ via frm_email parameter                                                           https://hackerone.com/reports/996535    @nagli         null
deptofdefense      high       Able to log in with default ██████g creds at https█████████████████████.mil                                        https://hackerone.com/reports/710813    @pirateducky   null
deptofdefense      medium     PHP info page disclosure                                                                                           https://hackerone.com/reports/1050912   @elpast        null
deptofdefense      high       Able to authenticate as administrator by navigating to https://█████/admin/                                        https://hackerone.com/reports/1035742   @nagli         null
h1-ctf             null       Solution for hackyholiday                                                                                          https://hackerone.com/reports/1065495   @holme         null
playstation        high       SOCK_RAW sockets reachable from Webkit process allows triggering double free in IP6_EXTHDR_CHECK                   https://hackerone.com/reports/943231    @theflow0      10000
h1-ctf             null       Flags for hackyholidays CTF                                                                                        https://hackerone.com/reports/1065516   @yashrs        null
h1-ctf             critical   It's just a man on a mission                                                                                       https://hackerone.com/reports/1069388   @thezoomer     null
h1-ctf             critical   Mission completed. Grinch Networks is down and Christmas saved.                                                    https://hackerone.com/reports/1067090   @yso           null