The newest Bug Bounty resources are on the Bug Bounty page. For a reading order instead of a date order, see the Bug Bounty learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2019-08-28 2019 | Bug Hunting Methodology from an Average Bug Hunter intermediate | The content discusses bug hunting methodology, addressing common industry questions about how bugs are sought out. It aims to provide insights into the process followed by bug hunters. |
| 2019-08-27 2019 | Finding Hidden API Keys & How to use them beginner | The content provided is too brief to summarize as it only contains a greeting. |
| 2019-08-25 2019 | Bug Bounty Forum beginner | Bug Bounty Forum is a community of over 150 security researchers who collaborate and share information. |
| 2019-08-24 2019 | Cookie worth a fortune | I'm Gaurav Narwani intermediate 4 min read | Writeup detailing how to convert a cookie-based Cross-Site Scripting (XSS) vulnerability into a Reflected XSS. The technique involves manipulating the `redirect` parameter to set a `redirectTo` cookie containing an XSS payload, followed by a second request to the login page without the `redirect` parameter, causing the application to execute the payload from the cookie. This process is demonstrated through a case study on a three-tier web application, illustrating the steps via HTTP requests and analyzing source code, and concludes with a CSRF Proof-of-Concept to automate the exploit. |
| 2019-08-21 2019 | The Bugs Are Out There, Hiding in Plain Sight advanced | The content discusses the challenging nature of bug bounty hunting, highlighting that success in this field requires years of experience. It emphasizes that top bug hunters have honed their skills over time, indicating that expertise is crucial for success in this specialized area. |
| 2019-08-21 2019 | Bug Hunting Methodology from an Average Bug Hunter intermediate | The content discusses bug hunting methodology from the perspective of an average bug hunter. It addresses common industry questions about bug hunting approaches and strategies. The post aims to provide insights into how bug hunters search for bugs and their methodologies. |
| 2019-08-20 2019 | Automated monitoring of subdomains for fun and profit — Release of Sublert intermediate | "Sublert" is a tool released for automated monitoring of subdomains for bug bounty programs. The bug bounty industry is rapidly growing, leading to fierce competition among programs. Sublert aims to assist in identifying security vulnerabilities in subdomains, potentially leading to financial rewards for bug hunters. |
| 2019-06-24 2019 | What I have learn in my first month of Hacking and Bug Bounty beginner | The content discusses the author's experiences and lessons learned in their first month of hacking, bug bounty programs, programming, and available resources like CIFs. The post aims to share insights and knowledge gained in these areas. |
| 2019-04-13 2019 | enaqx/awesome-pentest: A collection of awesome penetration testing resource beginner 37 min read | Library enaqx/awesome-pentest offers a curated collection of resources for penetration testing and offensive cybersecurity. It categorizes tools and guides for various domains including Android Utilities, Web Exploitation, Anti-virus Evasion Tools like AVET and Veil, and extensive book references such as "Black Hat Python" and "The Art of Exploitation." The library also lists exploit development tools, network scanners, and collaboration frameworks, providing a comprehensive reference for security professionals. |
| 2019-04-10 2019 | Spokeo Bug bounty Experience beginner | The content discusses the author's experience reporting an XSS bug in Spokeo's bug bounty program. |
| 2019-03-21 2019 | Source code disclosure via exposed .git folder · Pentester Land intermediate 3 min read | Tutorial on identifying and exploiting exposed `.git` folders on web applications. This method allows for the reconstruction of source code, potentially revealing critical vulnerabilities such as hardcoded credentials or new endpoints. The process involves domain enumeration using tools like Amass or Sublist3r, followed by forced browsing with tools like dirsearch to detect `.git` directory exposure, and automated extraction of repository contents using GitTools. Analyzing the retrieved source code can lead to significant bug bounty payouts, as seen in reports from vendors like Grabtaxi and Boozt Fashion. |