The newest Bug Bounty resources are on the Bug Bounty page. For a reading order instead of a date order, see the Bug Bounty learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2021-05-11 2021 | VPS-web-hacking-tools beginner Recon | Library for automatically installing web hacking and bug bounty tools on Debian, Kali Linux, Linux Mint, and Ubuntu VPS. Supports both direct installation via an installer script and a Docker image for containerized use. Includes tools such as Corsy and CORScanner. Users are advised to configure tools for effective subdomain enumeration and to use them only on authorized targets. |
| 2021-05-10 2021 | nOtWASP bottom 10: vulnerabilities that make you cry beginner 6 min read | Reference to the nOtWASP Bottom 10 highlights vulnerabilities often found in security reports that are impractical, misunderstood, or outdated. This list includes issues like overly strict session timeouts that annoy users, trivial information disclosures such as "Server: Apache" banners, and CSV injection vectors that require multiple user interactions. It also covers obsolete XSS techniques, unnecessary security headers like CSP on simple pages, tabnabbing, the overzealous application of httponly cookie flags, and vulnerable software version reporting without exploit validation. → portswigger.net |
| 2021-05-06 2021 | CVE-2019-15515 Detail news | Reference to CVE-2019-15515 provides advisories and solutions related to the vulnerability. Links are provided to external websites that may contain additional information, tools, or commercial products. NIST does not necessarily endorse the views or facts presented on these external sites. |
| 2021-05-04 2021 | Web App #Penetration Testing for Beginners: beginner Recon | This content is a title for a guide on web application penetration testing aimed at beginners. It suggests a resource that will introduce fundamental concepts and methodologies for testing the security of web applications. The title implies a focus on practical, introductory-level techniques and knowledge, making it accessible for individuals new to the field of cybersecurity and penetration testing. |
| 2021-04-13 2021 | Analysing JavaScript Files For Bug Bounty Hunters | by Thexssrat | Apr, 202 beginner | The content discusses the importance of analyzing JavaScript files for bug bounty hunters. It raises the question "What is JS even?" implying a deeper exploration into the significance of JavaScript in bug hunting activities. The article likely delves into the role of JavaScript in identifying vulnerabilities, understanding its impact on web security, and providing insights for bug bounty hunters on how to effectively analyze JavaScript files to uncover potential bugs and security flaws. → thexssrat.medium.com |
| 2021-04-10 2021 | Intro to Bug Bounty Automation (pt.2): Port Scanning with Slack | InfoSec W intermediate | The content discusses using Slack as a communication channel for delegating tasks like port scanning, even though Slack itself cannot perform port scans. It highlights the importance of utilizing automation tools and platforms like Slack to streamline bug bounty processes and improve efficiency in cybersecurity tasks. → infosecwriteups.com |
| 2021-04-04 2021 | GitHub - nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters: A list of reso beginner | Library of curated web hacking tools, tips, and resources for bug bounty hunters. It covers basics, blog posts, talks, setup, tools, labs, vulnerability types, mobile hacking, coding, scripting, media, and mindset. |
| 2021-03-07 2021 | GitHub - theinfosecguy/QuickXSS: Automating XSS using Bash intermediate XSS | Tool for automating XSS discovery, integrating waybackurls, gau, gf, and dalfox. QuickXSS simplifies setup with `pip install quickxss` or `pipx install quickxss` and an auto-installation script for dependencies. Scans can be performed with basic commands, blind XSS callbacks via `-b`, or custom output naming using `-o`. It also supports Docker builds and integration tests with pytest. |
| 2021-03-05 2021 | nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters: A list of resources for beginner | Library providing a curated collection of web hacking tools, tips, and resources for aspiring bug bounty hunters. It categorizes essential information including basic concepts, blog posts, talks, books, setup guides, tools, testing environments, vulnerability types, mobile hacking techniques, coding and scripting advice, media resources, and mindset guidance. The repository also links to Live Recon VODs featuring top bug bounty hunters and encourages community engagement via NahamSec's Discord. |
| 2021-02-24 2021 | Top 10 web hacking techniques of 2020 beginner 5 min read | Survey of top 10 web hacking techniques from 2020, highlighting advancements in WAF evasion with malformed chunk techniques, deep attacks on MS Exchange Web Interfaces, RCE via ImageMagick, unauthenticated RCE on MobileIron MDM, SSL client authentication bypass via header underscores, IP fragmentation for NAT slipstreaming, SNI injection for internal service exploitation, exploiting secondary contexts in web applications, PDF parser manipulation for data exfiltration, and H2C smuggling for request tunneling. → portswigger.net |
| 2021-02-21 2021 | Noob’s Basic JSON web Token Exploit Guide | by Circle Ninja | Bug Bounty Hu beginner | The content is a guide for exploiting JSON web tokens, aimed at beginners. It is written by Circle Ninja and is part of Bug Bounty Hu. The guide likely covers basic techniques and strategies for manipulating JSON web tokens for security testing purposes. |
| 2021-02-21 2021 | 002: Uncle Rat's Bug Bounty Guide beginner | The content is titled "002: Uncle Rat's Bug Bounty Guide." It appears to be a guide related to bug bounty programs. The guide may provide information and tips on how to participate in bug bounty programs, which involve finding and reporting security vulnerabilities in software or websites in exchange for rewards. Uncle Rat's Bug Bounty Guide likely offers insights and strategies for individuals interested in bug hunting as a way to contribute to cybersecurity and earn rewards for identifying vulnerabilities. |
| 2021-02-17 2021 | Finding My First Bug: HTTP Request Smuggling intermediate | The content describes the author's first bug discovery, which was related to HTTP Request Smuggling. The bug was reported and resulted in a bounty reward of $200. |
| 2021-02-17 2021 | HTTP Request Smuggling: A Primer beginner | The content provides an introduction to HTTP request smuggling, explaining its basics and offering guidance on self-protection. It aims to educate readers on understanding this vulnerability and taking measures to safeguard against potential risks. |
| 2021-02-16 2021 | A ffuf Primer | Daniel Miessler beginner 3 min read | Tool, ffuf, is a flexible CLI-based web attack utility written in Go, often compared to Burp Intruder on the command line. It excels at fuzzing by injecting input from wordlists into various parts of a web application, including URLs, GET parameters, and POST data. ffuf can emulate tools like Dirbuster and even perform password guessing, making it a versatile addition to a web tester's toolkit, especially when combined with curated wordlists like those found in RobotsDisallowed. → danielmiessler.com |
| 2021-02-08 2021 | BugBountyHunting.com - The Bug Bounty Writeups Search Tool beginner | BugBountyHunting.com is a platform that gathers writeups, resources, and content on bug bounty hunting to aid quick access. It aims to assist beginners in web application security by providing valuable information on bug bounty hunting. |
| 2021-01-24 2021 | WebApp Security CTF: [Dec 11–15] - Pwning under 5 mins intermediate | Learn how to quickly solve the WebApp Security Capture The Flag (CTF) challenge taking place from December 11 to 15 in under 5 minutes. |
| 2020-05-31 2020 | r/Hacking_Tutorials - Remote Code Execution explained with real life bug bounty reports intermediate RCE | The Reddit post on r/Hacking_Tutorials discusses Remote Code Execution with real-life bug bounty reports. It has received 36 votes but no comments yet. The content likely delves into the explanation of Remote Code Execution vulnerabilities using examples from bug bounty reports to provide practical insights and guidance on this hacking technique. |
| 2020-05-30 2020 | Security Tools | Curated list of security tools for Hackers & Builders! beginner 3 min read | Library of curated security tools for hackers and builders. It includes CDK for container penetration and Kubernetes cluster takeover, Kubernetes Goat for hands-on learning, KubeHound for visualizing Kubernetes attack paths, and aws-security-viz for EC2 security group visualization. GuardDog identifies malicious PyPI and npm packages, while Unfurl extracts and visualizes data from URLs. Stratus Red Team emulates cloud attack techniques, and TrashEmail offers disposable email addresses via Telegram. Terrascan detects IaC compliance violations, StreamAlert analyzes real-time data, and TerraGoat demonstrates Terraform configuration errors. Semgrep is a static analysis tool for code security, Cartography maps infrastructure assets, and TruffleHog discovers secrets. |
| 2020-03-21 2020 | Conference notes: The Bug Hunters Methodology v3(ish) (LevelUp 0x02 / 2018) beginner 13 min read | Reference notes from Jason Haddix's "The Bug Hunters Methodology v3(ish)" talk detail reconnaissance techniques. This includes discovering IP space via ASN lookups, ARIN/RIPE queries, and reverse WHOIS tools like reverse.report. Methods for finding new brands and TLDs involve analyzing acquisitions and utilizing Burp Suite's spider functionality. For subdomain discovery, the notes highlight scraping techniques using sources like crt.sh and DNSDB, recommending tools such as Amass and Subfinder, and exploring subdomain brute-forcing with Massdns. |
| 2020-02-14 2020 | Samesite by Default and What It Means for Bug Bounty Hunters intermediate 4 min read CSRF XSS | Analysis of SameSite=Lax cookie attribute default for bug bounty hunters, detailing its impact on Clickjacking, Cross-Site Script Inclusion (XSSI), JSONP Leaks, Data Exfiltration, XSLeaks, CORS Misconfigurations, Cross-Site WebSocket Hijacking, and XSS exploits that rely on cross-origin authenticated requests. The shift in default behavior, as implemented in Chrome 80, reduces the effectiveness of these vulnerabilities by preventing cookies from being sent in many cross-origin contexts. |
| 2020-01-19 2020 | Bug Bounty Toolkit - BugBountyHunting - Medium beginner | The content titled "Bug Bounty Toolkit" on BugBountyHunting's Medium page was last updated on January 17, 2021. |
| 2019-12-29 2019 | Bug Bounty — Tips / Tricks / JS (JavaScript Files) beginner | The content discusses the beginning of a bug bounty journey in August, where the author reached out to Gerben Javado with a basic question. The focus seems to be on bug bounty tips, tricks, and JavaScript files. The content likely delves into strategies for finding and reporting bugs, possibly emphasizing the importance of JavaScript files in identifying vulnerabilities. |
| 2019-12-03 2019 | GitHub - arkadiyt/bounty-targets-data: This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports beginner | Library containing hourly-updated data dumps of bug bounty platform scopes from Hackerone, Bugcrowd, Intigriti, Federacy, and YesWeHack. This resource offers lists of in-scope domains, including both direct and wildcard entries, to assist security researchers in identifying targets eligible for vulnerability reports. The data is refreshed every 30 minutes, and the generation code is available in a separate repository. |
| 2019-11-17 2019 | Understanding the full potential of sqlmap during bug bounty hunting intermediate SQLi | The content discusses leveraging sqlmap, a tool for exploiting SQL injection vulnerabilities, in bug bounty hunting. It highlights using offensive website security techniques and ethical hacking practices to identify and report security flaws. By understanding the full potential of sqlmap, bounty hunters can efficiently uncover vulnerabilities and earn rewards for responsibly disclosing them. The focus is on utilizing sqlmap effectively within bug bounty programs to enhance cybersecurity measures and protect websites from potential threats. |
| 2019-11-12 2019 | amass — Automated Attack Surface Mapping | Daniel Miessler intermediate 6 min read | Tool for automated attack surface mapping, `amass` gathers information across multiple dimensions, leveraging various input sources like DNS enumeration, scraping from search engines (Baidu, Bing, Google), certificate transparency logs (Censys, Crtsh), APIs (Shodan, VirusTotal), and web archives. Its modules include `intel` for information gathering, `enum` for attack surface mapping, `viz` for visualization, `track` for historical data, and `db` for database manipulation. Examples showcase finding organizations via `-org` and discovering domains within CIDR ranges using `-cidr`. → danielmiessler.com |
| 2019-10-03 2019 | jobertabma/relative-url-extractor: A small tool that extracts relative URLs intermediate | Tool that extracts relative URLs from minified JavaScript and other files by accepting STDIN input. It aids reconnaissance by surfacing potential targets for security researchers and bug bounty hunters, especially in complex frontend pipelines. The `--show-line` flag includes line excerpts for context. |
| 2019-10-03 2019 | GitHub - nahamsec/JSParser beginner | Library for parsing relative URLs from JavaScript files using Python 2.7, Tornado, and JSBeautifier. This tool aids in discovering AJAX requests during security research and bug bounty hunting, facilitating tasks like those demonstrated in IDOR and SSRF vulnerability analyses. It includes support for the safeurl library and can be installed and run via `setup.py` and `handler.py`. |
| 2019-09-07 2019 | How a Scottish schoolboy who failed computing makes millions hacking beginner 9 min read | Writeup profiling Mark Litchfield, an ethical hacker who failed his computing A-level but now earns millions by finding and reporting vulnerabilities to companies like Yahoo! and Google through platforms like HackerOne. The profile details his self-taught journey, his motivation being financial reward, and contrasts his success with the risks of criminal hacking, noting how major breaches like Equifax highlight the importance of bug bounty programs. |
| 2019-08-30 2019 | GitHub - fransr/bountyplz: Automated security reporting from markdown templ beginner 2 min read | Library for automated security reporting, supporting HackerOne and Bugcrowd. This tool creates draft reports from Markdown files, handling attachments, inline images, assets, weaknesses, and severity, including 2FA support. It parses Markdown frontmatter for report attributes like severity, weakness, and asset, and automatically uploads referenced images and videos. Reports are modified to prevent duplicates, with a force option available for re-submission. |
| 2019-08-30 2019 | GitHub - ZephrFish/BugBountyTemplates: A collection of templates for bug bo beginner 2 min read | Library of Markdown templates simplifies bug bounty report writing, offering solutions for various reporting needs. "Blank.md" provides guidance for detailed vulnerability documentation, "HeadersOnly.md" offers quick scaffolding for experienced researchers, and "short.md" is ideal for straightforward findings. "Example.md" serves as a reference for well-written reports, while specialized templates like "SSRF.md" and "API.md" cater to specific vulnerability types such as Server-Side Request Forgery and API flaws including BOLA and IDOR. The collection also includes guidance on essential elements like screenshots, HTTP requests, and impact demonstration, alongside common pitfalls to avoid. |
| 2019-08-30 2019 | Bug Bounty POC - All Bug Bounty POC write ups by Security Researchers. intermediate 2 min read | Writeups detail bug bounty findings including S3 bucket misconfigurations, Fastly errors, Vine user information disclosure, insecure Cross-Origin Resource Sharing, Sentry privilege escalation from manager to admin, Coinbase 2FA bypass during recurring payments, and Nextcloud's restore capability vulnerability allowing read-only users to restore old versions. |
| 2019-08-29 2019 | GitHub - ngalongc/bug-bounty-reference: Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature intermediate 11 min read | Reference catalog of bug bounty write-ups, categorized by vulnerability type. This resource compiles publicly disclosed reports covering common exploits such as XSS, SQL Injection, RCE, XXE, IDOR, CSRF, and brute force attacks. Specific examples include write-ups on vulnerabilities in Uber, Google, Facebook, Yahoo, and eBay, detailing techniques like Relative Path Overwrite, authentication bypass, and various code execution methods. |
| 2019-08-29 2019 | List of bug bounty writeups · Pentester Land intermediate | The content is a list of bug bounty writeups available on Pentester Land. These writeups likely detail successful bug bounty submissions, showcasing vulnerabilities found in various systems and applications. Readers can learn from these examples to improve their own bug hunting skills and understand common security flaws. Bug bounty programs offer rewards to ethical hackers who discover and report vulnerabilities, benefiting both the security of systems and the researchers who participate. |
| 2019-08-28 2019 | The Bugs Are Out There, Hiding in Plain Sight advanced | The content discusses the challenging nature of bug bounty hunting, emphasizing that success in this field requires years of experience. The top hunters have honed their skills over time, making it difficult for newcomers to achieve the same level of success quickly. Bug bounty hunting is portrayed as a field that demands dedication and expertise to excel. |
| 2019-08-28 2019 | Bug Hunting Methodology from an Average Bug Hunter intermediate | The content discusses bug hunting methodology, addressing common industry questions about how bugs are sought out. It aims to provide insights into the process followed by bug hunters. |
| 2019-08-27 2019 | Finding Hidden API Keys & How to use them beginner | The content provided is too brief to summarize as it only contains a greeting. |
| 2019-08-25 2019 | Bug Bounty Forum beginner | Bug Bounty Forum is a community of over 150 security researchers who collaborate and share information. |
| 2019-08-24 2019 | Cookie worth a fortune | I'm Gaurav Narwani intermediate 4 min read | Writeup detailing how to convert a cookie-based Cross-Site Scripting (XSS) vulnerability into a Reflected XSS. The technique involves manipulating the `redirect` parameter to set a `redirectTo` cookie containing an XSS payload, followed by a second request to the login page without the `redirect` parameter, causing the application to execute the payload from the cookie. This process is demonstrated through a case study on a three-tier web application, illustrating the steps via HTTP requests and analyzing source code, and concludes with a CSRF Proof-of-Concept to automate the exploit. |
| 2019-08-21 2019 | The Bugs Are Out There, Hiding in Plain Sight advanced | The content discusses the challenging nature of bug bounty hunting, highlighting that success in this field requires years of experience. It emphasizes that top bug hunters have honed their skills over time, indicating that expertise is crucial for success in this specialized area. |
| 2019-08-21 2019 | Bug Hunting Methodology from an Average Bug Hunter intermediate | The content discusses bug hunting methodology from the perspective of an average bug hunter. It addresses common industry questions about bug hunting approaches and strategies. The post aims to provide insights into how bug hunters search for bugs and their methodologies. |
| 2019-08-20 2019 | Automated monitoring of subdomains for fun and profit — Release of Sublert intermediate | "Sublert" is a tool released for automated monitoring of subdomains for bug bounty programs. The bug bounty industry is rapidly growing, leading to fierce competition among programs. Sublert aims to assist in identifying security vulnerabilities in subdomains, potentially leading to financial rewards for bug hunters. |
| 2019-06-24 2019 | What I have learn in my first month of Hacking and Bug Bounty beginner | The content discusses the author's experiences and lessons learned in their first month of hacking, bug bounty programs, programming, and available resources like CIFs. The post aims to share insights and knowledge gained in these areas. |
| 2019-04-13 2019 | enaqx/awesome-pentest: A collection of awesome penetration testing resource beginner 37 min read | Library enaqx/awesome-pentest offers a curated collection of resources for penetration testing and offensive cybersecurity. It categorizes tools and guides for various domains including Android Utilities, Web Exploitation, Anti-virus Evasion Tools like AVET and Veil, and extensive book references such as "Black Hat Python" and "The Art of Exploitation." The library also lists exploit development tools, network scanners, and collaboration frameworks, providing a comprehensive reference for security professionals. |
| 2019-04-10 2019 | Spokeo Bug bounty Experience beginner | The content discusses the author's experience reporting an XSS bug in Spokeo's bug bounty program. |
| 2019-03-21 2019 | Source code disclosure via exposed .git folder · Pentester Land intermediate 3 min read | Tutorial on identifying and exploiting exposed `.git` folders on web applications. This method allows for the reconstruction of source code, potentially revealing critical vulnerabilities such as hardcoded credentials or new endpoints. The process involves domain enumeration using tools like Amass or Sublist3r, followed by forced browsing with tools like dirsearch to detect `.git` directory exposure, and automated extraction of repository contents using GitTools. Analyzing the retrieved source code can lead to significant bug bounty payouts, as seen in reports from vendors like Grabtaxi and Boozt Fashion. |