GoScope

A tool I made to quickly store bug bounty program scopes in a local sqlite3 database. Download or copy a Burpsuite configuration file from the bonty program page and save it as a .json file. Source it using GoScope and it will parse the file, storing a program name, in-scope domains and out-of-scope domains to the database.

I have only tested this with a few HackerOne Burpsuite configurations. I am uncertain if other platforms use the same format.

Disclaimer

Always double-check that the scope information in the database matches the listings on the bounty program page. I have found that some programs do not include out-of-scope domains in the Burpsuite configuration files. These can be manually added in to the .json file and then run through GoScope.

Usage

Due to the long urls these configuration files have, I find it easier just to open the link in a new tab, ctrl-a and copy all data, and then paste it into a .json file. The long links tend to lag my terminal.

GoScope is configured to utilize subcommands and flags.

E.x. goscope [command] <flags>

goscope -h

This will display help for the tool.

Command	Description	Example
add	Add a new bounty program	goscope add -p example -b example.json
query	Query the database and return inscope and outscope	goscope query -p example
remove	Remove a program from the database	gorecon remove -p example
pipe	Output only wildcard domains and pipe to other enumeration tools such as assetfinder	goscope pipe -p example

Flags	Valid Commands	Description	Example
-a	pipe	Output all wildcard domains for all programs in database	goscope pipe -a
-b	add	Burpsuite config file	goscope add -p example -b burp.json
-c	all	Config file location (default $HOME/.goscope.yaml)	Can set default database name / location here
-d	all	Specify database name and location (default ./scope.db)	goscope add -d example.db
-h	all	See help for any command	goscope add -h
-l	query	List all programs in database	goscope query -l
-p	all	Set the name of the bounty program	goscope query -p example

Installation

GoScope requires sqlite3 for the database

▶ sudo apt install sqlite3

GoScope requires go1.17+ to install successfully. Run the following command to get the repo -

▶ GO111MODULE=on go get -v github.com/d82r/goscope

Running GoScope

Add a new bounty program scope to the database.

▶ goscope -p example -b example.json 

Query an existing program

▶ goscope query -p example

Remove a program from the database

▶ goscope remove -p example

Output program wildcard domains (*.example.com) to stdout as example.com so it can be pipe to tools such as assetfinder or subfinder

▶ goscope pipe -a