A HackerOne API client for Python. The API closely maps to the REST API that HackerOne provides. Documentation for their API is available here.
MIT
For installation via pip:
pip install h1For development, In the project root run:
virtualenv env
source env/bin/activate
make bootstrapThe manual approach should work as well:
python setup.py install>>>fromh1.clientimportHackerOneClient>>>fromh1.modelsimportReport>>>c=HackerOneClient("YOUR-API-TOKEN-IDENTIFIER", "YOUR-API-TOKEN")HackerOneClient.find_resources() allows you to specify a resource to find (only Report is
supported for now) and some criteria to filter on. The only required filter is program, which
must be set to the target HackerOne program's name. Any additional filters may be passed as kwargs,
and everything in HackerOne's filter documentation
should be supported.
For example, here's how we'd get all reports created in the past 24 hours:
>>>importdatetimeasdt>>>day_ago=dt.datetime.now() -dt.timedelta(days=1)
>>>listing=c.find_resources(Report, program=["test-program"], created_at__gt=day_ago)
>>>len(listing)
3>>>listing[0].titleu'This is a test report!'Similarly, if we filter on state we can get all the resolved reports:
>>>resolved_listing=c.find_resources(Report, program=["test-program"], state=["resolved"])
>>>resolved_listing[0].titleHackerOneClient.get_resource() allows you to pass a resource type (again, currently just Report,)
and an ID to fetch:
>>>report=c.get_resource(Report, 110306)
>>>report.titleu'Test RCE SQLi'>>>report.stateu'not-applicable'Here's an example of using the client to figure out who your most prolific reporters are:
>>>fromcollectionsimportCounter>>>reporter_count=Counter()
>>>all_reports=c.find_resources(Report, program=["test-program"])
>>>forreportinall_reports:
... reporter_count[report.reporter] +=1
...
>>>print(reporter_count)
Counter({<User-bestreporter>: 21, <User-another_reporter>: 12, <User-r3p0rt3r>: 2, <User-newbie>: 1})virtualenv env
source env/bin/activate
make bootstrap
make test