-
Notifications
You must be signed in to change notification settings - Fork 20
Description
Hi! After installing the extension YesWeBurp (version 2.0.2), I went to the tab and clicked "Fetch programs" which only resulted in an error so I can't use the extension?
It seems I can't copy the text but it goes like this:
Instantiation of [simple type, class yesweburp.api.Program] value failed for JSON property qualifying_vulnerability due to missing (therefore NULL) value ... at [Source: (byte[])]"{"title":"GovTech ...
I went to the Logger tab in Burp, found GET api.yeswehack.com/programs?page=1 then I dig to find this "GovTech".
So it happens on what appears to be the unique VDP from https://yeswehack.com/programs/vdp (GovTech only at the moment)
All items have "type":"bug-bounty" except this VDP which has "type":"vdp-in-app".
I suppose VDPs should be filtered out to only display bug bounty programs.
I imagine a change should be done there:
YesWeBurp/src/main/kotlin/yesweburp/api/API.kt
Lines 97 to 98 in 67c9499
| val response: Page<ShortProgram> = get("/programs?page=$page") | |
| response.items.stream().parallel().forEach { data.add(get("/programs/${it.slug}")) } |
(Or update the API.)
EDIT: Maybe something like Better if (it.type == "bug-bounty") just before data.add(get("/programs/${it.slug}")) (I did not write Kotlin before)./programs?filter[type][]=bug-bounty&page=$page
I failed to recompile the extension in IDEA (outdated kotlin for a start), I eventually edited the string /programs?page= in the raw jar file with some tool to insert the filter, it now works fine, as far as I know.
EDIT 2: It seems the YesWeCaido plugin supports both types.
https://github.com/yeswehack/yeswecaido/blob/e2a1a673cff794428dfcb6b3490a6b9b2f655a56/packages/common/src/types.ts#L57
https://github.com/yeswehack/yeswecaido/blob/e2a1a673cff794428dfcb6b3490a6b9b2f655a56/packages/frontend/src/components/ProgramTypeChip.vue#L17-L20