Skip to content

Can't fetch programs because VDP does not have qualifying_vulnerability key #13

@phackc

Description

@phackc

Hi! After installing the extension YesWeBurp (version 2.0.2), I went to the tab and clicked "Fetch programs" which only resulted in an error so I can't use the extension?
It seems I can't copy the text but it goes like this:

Instantiation of [simple type, class yesweburp.api.Program] value failed for JSON property qualifying_vulnerability due to missing (therefore NULL) value ... at [Source: (byte[])]"{"title":"GovTech ...

I went to the Logger tab in Burp, found GET api.yeswehack.com/programs?page=1 then I dig to find this "GovTech".
So it happens on what appears to be the unique VDP from https://yeswehack.com/programs/vdp (GovTech only at the moment)
All items have "type":"bug-bounty" except this VDP which has "type":"vdp-in-app".

I suppose VDPs should be filtered out to only display bug bounty programs.
I imagine a change should be done there:

val response: Page<ShortProgram> = get("/programs?page=$page")
response.items.stream().parallel().forEach { data.add(get("/programs/${it.slug}")) }

(Or update the API.)

EDIT: Maybe something like if (it.type == "bug-bounty") just before data.add(get("/programs/${it.slug}")) (I did not write Kotlin before). Better /programs?filter[type][]=bug-bounty&page=$page
I failed to recompile the extension in IDEA (outdated kotlin for a start), I eventually edited the string /programs?page= in the raw jar file with some tool to insert the filter, it now works fine, as far as I know.

EDIT 2: It seems the YesWeCaido plugin supports both types.
https://github.com/yeswehack/yeswecaido/blob/e2a1a673cff794428dfcb6b3490a6b9b2f655a56/packages/common/src/types.ts#L57
https://github.com/yeswehack/yeswecaido/blob/e2a1a673cff794428dfcb6b3490a6b9b2f655a56/packages/frontend/src/components/ProgramTypeChip.vue#L17-L20

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions