scope-aggregate

---
description: Pull every in-scope asset for a bug bounty program across HackerOne, Bugcrowd, Intigriti, YesWeHack, and Immunefi in one shot. Uses bbscope when authenticated, otherwise the public bounty-targets-data dump. Output is one host per line, ready to feed into /recon. Usage: /scope-aggregate <program-handle> [--platform h1|bc|it|ywh|imf|all]
---

# /scope-aggregate

Aggregate the full in-scope asset list for a public program without copy-pasting
from the program page.

## Usage

```
/scope-aggregate shopify
/scope-aggregate yelp --platform h1
/scope-aggregate --list-programs --platform h1
```

## What it does

`tools/scope_aggregator.sh` runs in two strategies:

1. **bbscope** (`sw33tLie/bbscope`) — authenticated multi-platform pull. Best
   freshness, but needs platform tokens in env (`H1_USERNAME`, `H1_API_KEY`,
   `BUGCROWD_EMAIL`, etc.). Tries it first when installed.
2. **bounty-targets-data dump** (`arkadiyt/bounty-targets-data`) — hourly
   public dump of every public program. No auth needed; fallback if bbscope
   returns nothing.

Output: `~/.cache/bbhunt/scope/<program>.scope.txt` (one host per line, with
wildcards stripped to bare domains).

## Next steps

```
/scope ~/.cache/bbhunt/scope/<program>.scope.txt   # human verification
/recon ~/.cache/bbhunt/scope/<program>.scope.txt   # feed into recon (domain-list mode)
```

`recon_engine.sh` already supports passing a file in place of a domain — it
reads each line as a pre-resolved scope entry and skips subdomain enumeration
(programs without wildcards benefit hugely).

## When NOT to use

- Programs with `*.target.com`-style wildcards: aggregator gives you the
  *seed*; still run `/recon target.com` to brute the wildcard.
- Private programs you cannot install bbscope creds for: bounty-targets-data
  only covers public scope, so private invites won't appear.