This is an update to the original mBot release post covering what changed between v1.0.0 (October 2021) and v2.0.0.

Background

In late March / early April 2021 my application to Synack was approved and I gained access to the platform. The first few days were spent fumbling through menus and figuring out how to navigate. After talking with some of the more experienced members I was told quickly that I needed a mission bot if I wanted any chance of grabbing missions. One member shared their bot with me and for several months I was able to claim multiple missions a day without issue.

Eventually changes to the platform started impacting how that bot worked with the mission API. My access to missions began diminishing as I was constantly disconnected or beaten to claims by an increasingly prevalent number of bots. Around this time I was learning Go, and decided to further that learning by building a custom mission bot for the Synack API.

I released version 1.0.0 in October 2021 with minimal functionality: just enough to claim missions and onboard to targets. Since then I had spent significant time on improvements aimed at automating the routine parts of mission work.

With Synack’s release of the Mission Trust Wallet feature, I no longer have the time to spend on missions for the now reduced compensation. Rather than let the bot sit unused, I am releasing v2.0.0 to the community.

Key features in v2.0.0

2FA login automation

Frequent session timeouts on the Synack platform made automated login a priority. Two-factor authentication was the main blocker for automation. The authy Go library handled the 2FA flow cleanly, and the rest of the login process was straightforward to script after that.

Discord notifications

The bot was claiming missions, but I was occasionally going a full day without checking whether anything had been claimed. I added notifications using the discordgo package. The current implementation only emits notifications for claimed missions, but the same plumbing should make broader command-and-control functionality straightforward to add later.

Mission templates

v2.0.0 includes scaffolding for mission templates that pre-populate fields when a mission is claimed. Used properly this should reduce write-up time substantially.

Target blacklisting

After claiming multiple missions for a target that turned out to be non-functional more than once (those who know, know), I implemented a blacklist. Any target name on the blacklist is skipped during the claim flow.

Future work

The bot was still a work in progress when I shelved active development. There are hints in the source of features that were partway in for anyone interested in continuing the work.

Getting it

The repository is at github.com/un4gi/mBot. Read through the code and configure the default settings before running. mBot is intended to be invoked with arguments as documented in the README. The default check-in interval is set to one second deliberately, as a deterrent against running it without first reading what it does.

A note on use

This bot was built and used by me on the Synack platform. Synack’s terms of service and acceptable use policies have changed over time. If you fork or run this code, the responsibility for compliance with whatever the current rules are at the time you run it is yours, not mine. The original code is provided as-is for reference and as a starting point for further work.