HackerOne

HackerOne

You can import HackerOne Bug Bounty reports into OX as DAST findings. Researcher-submitted vulnerabilities are then triaged, filtered, and reported next to the rest of your dynamic application security testing results.

What OX imports from a HackerOne report

OX creates one DAST finding per imported report. The finding keeps a link back to the report on HackerOne, so a reviewer can open the original submission.

OX finding	Source in the HackerOne report
Title	The report title.
Description	The vulnerability information written by the researcher.
Severity	The report severity rating. Critical, high, medium, and low map directly, none maps to info, and an unrated report is imported as medium so it stays visible.
CVSS	The severity score and vector of the report, when the report is rated.
CWE	The weakness of the report, normalized to CWE-<number>. A weakness that is not a CWE is dropped.
CVE	The first CVE listed on the report, when the report carries one.
Asset	The asset identifier of the structured scope. A report with no structured scope falls back to the program handle.
Tags	The program handle, the reporter user name, and the current HackerOne state of the report.
Link	The report page on HackerOne, reachable from the finding as the external product link.
Created	The submission time of the report.

Report states that OX imports

OX imports reports in the New, Triaged, Pending Program Review, and Needs More Info states. Reports in every other state are skipped, so duplicate, informative, not applicable, and spam submissions never become OX findings.

Resolved and retesting reports follow the OX scan lifecycle. When an imported report leaves the active set, its OX issue resolves on the next scan.

Prerequisites

• OX organization admin: Only an organization admin can add or change a connector credential.

Step 1: Create an API token [HackerOne]

1. Sign in to HackerOne as an organization admin.

2. Go to Organization Settings > API Tokens.

3. Create a new API token.

4. Grant the token access to the programs you want OX to import. Note: A token that sees no programs cannot complete the connection in Step 2.

5. Copy the API token identifier and the API token value. The identifier is the user name, and the value is the token.

Step 2: Connect HackerOne to OX

1. In the OX platform, go to the Connectors page.

2. Select Add Connector and search for HackerOne .

Complete the fields, then select Verify Connectivity to confirm the credentials, and select Connect to save them.

Field	What to use
HackerOne Host URL	The HackerOne API host. OX prefills https://api.hackerone.com, which is correct for the public platform. Change it only if your organization reaches the HackerOne API on another host.
User Name	The API token identifier from Step 1, not the email address of a HackerOne user.
API Token	The API token value from Step 1. OX stores it encrypted and never displays it again.

1. Select CONNECT.

2. To select specific HackerOne programs to import, click the gear icon next to the DELETE button.

3. Select the HackerOne projects and select SAVE.

When connected, OX starts pulling DAST data from Applause.