The newest Bug Bounty resources are on the Bug Bounty page. For a reading order instead of a date order, see the Bug Bounty learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2025-08-14 2025 | Top 10 web hacking techniques of 2022 | PortSwigger Research intermediate 6 min read | Survey of the top 10 web hacking techniques from 2022, highlighting vulnerabilities like request smuggling, client-side path traversal, and Psychic Signatures in Java. The research also covers exploiting Web3's hidden attack surface with XSS and SSRF, bypassing .NET Serialization Binders, and insecure SAML implementations leading to bytecode execution. Practical client-side path-traversal attacks are identified, alongside cache poisoning on Akamai Edge Nodes and Zimbra Email credential theft via Memcache injection. Browser-powered desync attacks and account hijacking through OAuth dirty dancing are also detailed. → portswigger.net |
| 2025-08-14 2025 | HTTP Host Header Attacks intermediate | The content discusses HTTP-Host header attacks and is authored by Hashar Mujahid. It seems to provide information or insights related to this type of cyber attack. → infosecwriteups.com |
| 2025-08-14 2025 | Bug Bounty — Tips / Tricks / JS (JavaScript Files) - InfoSec Write-ups - Me intermediate | The content discusses bug bounty tips, tricks, and JavaScript (JS) files in the context of InfoSec write-ups. It likely includes insights, strategies, and techniques related to identifying and exploiting security vulnerabilities in web applications through bug bounty programs. The author may share their experiences, knowledge, and recommendations for effectively finding and reporting bugs in JavaScript files to enhance cybersecurity practices. |
| 2025-08-14 2025 | dsopas/assessment-mindset: Security Mindmap that could be useful for the infosec community when doing pentest, bug… beginner 1 min read | Mindmap structured around security assessment methodologies, including WAHH, OWASP API Security Top 10, and the IoT PenTesting Guide. Exported in OPML, XMind, and PNG formats, it aids organization for pentests, bug bounties, and red-team engagements. Contributions via pull requests are welcomed for new tasks, tools, and sections like mobile applications, networking, Wi-Fi, and IoT. |
| 2025-08-14 2025 | The Hitchhiker’s Guide to Bug Bounty Hunting Throughout the Galaxy. v2 beginner | The content is titled "The Hitchhiker’s Guide to Bug Bounty Hunting Throughout the Galaxy. v2." It suggests a guide or resource for individuals interested in bug bounty hunting, a practice where individuals find and report security vulnerabilities in exchange for rewards. The title alludes to the popular book "The Hitchhiker's Guide to the Galaxy," implying a whimsical or humorous approach to the subject matter. It likely provides tips, strategies, and insights for bug bounty hunters operating in a wide range of environments or platforms. |
| 2025-08-14 2025 | commixproject/commix: Automated All-in-One OS Command Injection Exploitatio intermediate | Tool for automated OS command injection detection and exploitation. Commix supports various injection types, automatically identifies them, and can perform file system and remote command execution. It offers options for bypassing filters and provides detailed usage examples in its wiki. |
| 2025-08-14 2025 | Bug Bounty Forum beginner | The content provided is a URL link to bugbountyforum.com. The website likely focuses on bug bounty programs, where individuals can report security vulnerabilities in exchange for rewards. It serves as a platform for security researchers and companies to collaborate in identifying and fixing potential security issues. The forum may offer discussions, resources, and opportunities related to bug bounty programs. |
| 2025-08-14 2025 | Bug Bounty POC - All Bug Bounty POC write ups by Security Researchers. intermediate 2 min read | Writeups from BugBountyPOC.com detail various security vulnerabilities and their exploitation. Topics include S3 bucket misconfigurations, information disclosure of user IP addresses and private Vine user data, Fastly error domain issues, insecure Cross-Origin Resource Sharing, privilege escalation on Sentry, Coinbase recurring payment 2FA bypass, and Nextcloud restore capability flaws allowing read-only users to restore old versions. |
| 2025-08-14 2025 | Oxml XXE payload inject tool docem intermediate XXE | The content discusses a tool called "Docem" developed by a security researcher to inject XXE payloads into OXML files. XXE (XML External Entity) vulnerabilities can be exploited to manipulate XML data and potentially lead to security breaches. The tool automates the process of injecting malicious payloads into Office Open XML (OXML) files, making it easier for security professionals to test and identify vulnerabilities in systems that process XML data. The tool's capabilities and potential impact on security testing are highlighted in the article. |
| 2025-08-14 2025 | How to discover up to 10,000 subdomains with your own tool | by _Y000_ | In intermediate | The content discusses a method to uncover up to 10,000 subdomains using a self-created tool by _Y000_. It likely provides insights or instructions on how to utilize this tool effectively for discovering subdomains efficiently. The focus is on empowering individuals to explore a large number of subdomains using a personalized tool. → infosecwriteups.com |
| 2025-08-14 2025 | How to discover up to 10,000 subdomains with your own tool | by _Y000_ | Ne intermediate Recon | The content discusses a method to uncover up to 10,000 subdomains using a self-created tool by _Y000_ on the platform Ne. The focus is on the process of discovering subdomains efficiently through the tool. |
| 2025-08-14 2025 | A ffuf Primer | Daniel Miessler beginner 3 min read | Tool for command-line web attacks, ffuf emulates functionality similar to Burp Intruder and Dirbuster. This Go-based utility leverages input files to fuzz parts of URLs, including GET parameters and POST data, for discovering vulnerabilities like disallowed paths and credential stuffing. It offers extensive options for matching responses based on HTTP codes, line counts, or size, and can be used with wordlists such as curated.txt from the RobotsDisallowed project to enhance the likelihood of finding sensitive information. → danielmiessler.com |
| 2025-08-14 2025 | Website Penetration Testing and Database Hacking with Sqlmap - Secnhack intermediate 6 min read | Tool for automated SQL injection detection and exploitation. This guide demonstrates using sqlmap to find and exploit SQL injection vulnerabilities in web applications, covering techniques like Google Dorking to identify targets and then using commands to dump database names, tables, columns, and ultimately sensitive data like user credentials. |
| 2025-08-14 2025 | Remote code execution explained with real life… beginner RCE | The content discusses remote code execution, explaining how it works with real-life examples. It likely covers the concept of executing code on a remote system, potential vulnerabilities that can be exploited, and the implications of such attacks. The post may provide insights into how hackers can gain unauthorized access to systems through this method and how to prevent such security breaches. It could also include practical tips or demonstrations to help readers understand the risks associated with remote code execution and how to protect against it. |
| 2025-08-14 2025 | Security Tools | Curated list of security tools for Hackers & Builders! beginner 3 min read | Library of curated security tools for hackers and builders, featuring solutions for container penetration (CDK), Kubernetes security practice (Kubernetes Goat), attack path analysis (KubeHound), AWS security visualization (aws-security-viz), malicious package detection (Guarddog), URL data extraction (Unfurl), cloud adversary emulation (Stratus Red Team), disposable email (TrashEmail), Infrastructure as Code security (Terrascan, TerraGoat), static code analysis (Semgrep), infrastructure asset mapping (Cartography), secrets discovery (TruffleHog), and real-time data analysis (StreamAlert). |
| 2025-08-14 2025 | devanshbatham/Awesome-Bugbounty-Writeups beginner 19 min read XSS | Writeup collection detailing numerous Cross-Site Scripting (XSS) variations, including DOM-based, reflected, and stored XSS, along with other vulnerabilities like CSRF, IDOR, LFI, SSRF, and RCE. Entries cover bypass techniques for WAFs and filters, specific vendor vulnerabilities on platforms like Google, Microsoft, Facebook, and Amazon, and methods for achieving account takeover and privilege escalation. Techniques include Angular JS template injection, MIME sniffing, Unicode bypass, and leveraging SWF files. |
| 2025-08-14 2025 | (224) @Th3G3nt3lman Shares His Recon Methodology and How He Consistently Co intermediate | @Th3G3nt3lman discusses his recon methodology and how he maintains consistency. The content likely delves into strategies, techniques, or processes used by @Th3G3nt3lman for reconnaissance activities. It may touch on the importance of having a structured approach to gathering information and how this contributes to achieving consistent results. |
| 2025-08-14 2025 | Samesite by Default and What It Means for Bug Bounty Hunters intermediate 4 min read CSRF XSS | Analysis of SameSite by Default cookie attribute's impact on web vulnerabilities. This change, which sets SameSite=Lax for all cookies by default in Chrome 80, significantly affects bug classes beyond CSRF. Vulnerabilities such as Clickjacking, Cross-Site Script Inclusion (XSSI), JSONP Leaks, Data Exfiltration, XSLeaks, and Cross-Site WebSocket Hijacking are impacted by the prevention of authenticated cross-origin requests. While CORS misconfigurations and certain XSS attack vectors may see less direct impact, the widespread adoption of this attribute necessitates a re-evaluation of common exploitation techniques for bug bounty hunters. |
| 2025-08-14 2025 | Bug-bounty/bugbounty_checklist.md at master · sehno/Bug-bounty beginner 5 min read | Checklist for comprehensive bug bounty methodology, encompassing reconnaissance with tools like Amass, Subfinder, and ffuf, information gathering, and security testing across authentication, session management, authorization, and various injection vulnerabilities including SQL, XXE, and NoSQL. It also details checks for file upload security, cryptographic issues, denial of service, and specific OWASP categories like cross-site scripting (XSS) and cross-site request forgery (CSRF). |
| 2025-08-14 2025 | Hunting good bugs with only HTML intermediate | The content discusses a method of finding security vulnerabilities in websites using only HTML, focusing on the concept of "good bugs" or vulnerabilities that can be reported to website owners for ethical hacking purposes. It explains how to identify and report these bugs, emphasizing responsible disclosure to help improve website security. The article provides insights into the ethical hacking process and encourages individuals to contribute positively to cybersecurity by reporting vulnerabilities to website owners for remediation. |
| 2025-08-14 2025 | arkadiyt/bounty-targets-data: This repo contains hourly-updated data dumps of bug bounty platform scopes (like… beginner | Database of HackerOne and Bugcrowd bug bounty program scopes, containing lists of in-scope domains and wildcards. Includes raw JSON data for Bugcrowd, Hackerone, Federacy, Intigriti, and YesWeHack platforms. Data is updated every 30 minutes. |
| 2025-08-14 2025 | dsopas/assessment-mindset: Security Mindmap that could be useful for the in beginner 1 min read | Mindmap for security assessments, incorporating the WAHH Methodology, OWASP API Security Top 10, and the IOT PenTesting Guide. Available in OPML, XMind, and PNG formats, this resource aids in organizing tasks for pentests, bug bounties, and red-team exercises. Contributions and suggestions for new tasks, tools, or improvements are welcomed via pull requests to the repository. |
| 2025-08-14 2025 | Understanding the full potential of sqlmap during bug bounty hunting intermediate SQLi | The content discusses maximizing the potential of SQLmap during bug bounty hunting. It covers the importance of understanding SQL injection vulnerabilities, using SQLmap effectively, and customizing its options for better results. The article emphasizes the significance of proper reconnaissance, parameter identification, and evasion techniques to enhance the success rate of SQL injection attacks. It also provides insights into exploiting blind SQL injection vulnerabilities and leveraging SQLmap's advanced features to automate the detection and exploitation process. Overall, the content aims to help bug bounty hunters utilize SQLmap efficiently for discovering and exploiting SQL injection vulnerabilities. |
| 2025-08-14 2025 | amass — Automated Attack Surface Mapping | Daniel Miessler beginner 6 min read | Tool for mapping attack surfaces, amass automates information gathering across multiple dimensions, integrating data from DNS enumeration, scraping various search engines, certificate transparency logs, and numerous APIs. It offers subcommands like `intel` for initial reconnaissance, `enum` for subdomain discovery and attack surface mapping, `viz` for visualizing results (including D3 and Maltego formats), `track` for historical analysis, and `db` for database management. Amass prioritizes diverse input sources and consistent developer attention, making it a robust solution for both offensive and defensive security operations. → danielmiessler.com |
| 2025-08-14 2025 | How To Setup an Automated Sub-domain Takeover Scanner for All Bug Bounty Pr intermediate | The content discusses setting up an automated sub-domain takeover scanner for bug bounty programs. It likely provides guidance on using tools or scripts to detect potential sub-domain takeover vulnerabilities automatically. This process can help security researchers identify and report such issues to organizations before they are exploited by malicious actors. Overall, the content aims to assist bug bounty hunters in efficiently scanning for sub-domain takeover vulnerabilities to enhance the security of web applications. |
| 2025-08-14 2025 | (640) An overlooked parameter leads to a critical SSRF in Dropbox bug bount intermediate SSRF | The content discusses a critical Server-Side Request Forgery (SSRF) vulnerability discovered in Dropbox's bug bounty program due to an overlooked parameter. This vulnerability could potentially allow attackers to manipulate server requests and access sensitive information. The SSRF flaw was identified as a significant security issue that could have serious consequences if exploited. This finding highlights the importance of thorough security testing and the need for companies to prioritize identifying and addressing such vulnerabilities to protect their systems and data. |
| 2025-04-10 2025 | Best Browser Extensions for Bug Hunting and Cybersecurity beginner Burp | If you are getting into bug hunting or cybersecurity the right tools can make a huge difference. Browser extensions help automate tasks, find hidden vulnerabilities and protect your privacy. Here is… → infosecwriteups.com |
| 2025-03-31 2025 | Javascript Recon for Bug Bounty & Pentesting intermediate Recon XSS | Hidden endpoints, secrets, and DOM XSS using Automated JS Analysis |
| 2025-03-30 2025 | Stored XSS in My Flow To RCE in Opera Browser #2 - Renwa - Medium intermediate RCE XSS | Hey Opera team, after your great response and bounties with previous reports motivated me to look more into the program and find more bugs, luckily I found a critical bug in My Flow that allow an… |
| 2025-03-16 2025 | GitHub - m4ll0k/BBTz: BBT - Bug Bounty Tools (examples💡) intermediate | BBT - Bug Bounty Tools (examples💡). Contribute to m4ll0k/BBTz development by creating an account on GitHub. |
| 2025-02-20 2025 | How I got a Stored XSS by searching through JS files. intermediate XSS | Hello Friend, I’m gonna talk about a simple Stored XSS vulnerability I did find in a private bug bounty program at Bugcrowd by searching in… |
| 2025-02-10 2025 | My Bug Hunting Methodology Approach to Finding Bugs Easily 🐞💡 intermediate | إِنَّ اللَّهَ وَمَلَائِكَتَهُ يُصَلُّونَ عَلَى النَّبِيِّ ۚ يَا أَيُّهَا الَّذِينَ آمَنُوا صَلُّوا عَلَيْهِ وَسَلِّمُوا تَسْلِيمًا |
| 2025-01-28 2025 | GitHub - Mehdi0x90/Web_Hacking: Bug Bounty Tricks and useful payloads and bypasses for Web Application Security. intermediate 1 min read | Library of bug bounty and pentest notes encompassing a wide array of web application security vulnerabilities and bypass techniques. It includes specific attack vectors such as API Key Leaks, CORS, CRLF Injection, CSRF, Cache Poisoning, Command Injection, DOM Clobbering, File Inclusion, File Upload, GraphQL, Host Header Injection, IDOR, JWT, NoSQLi, Open Redirect, Race Condition, Reverse Tab Nabbing, SQLi, SSRF, Sandwich Attacks, XSS, and XXE. Additionally, it features various bypass strategies for 403 errors, 429 limits, Captchas, CSP, Email Verification, Login, Rate Limits, and Password Resets, along with an extensive list of evasive techniques and tools like Nuclei, inql, Logger++, param-miner, Oralyzer, SQLiPy, ParamSpider, and gf. |
| 2025-01-19 2025 | Choosing Your First Program in Bug Bounties: A Beginner’s Guide beginner | Hey geeks, it4chis3c (Twitter) comes up with another write-up in my Bug Bounty Hunting Series: |
| 2024-12-31 2024 | Hidden Gems: Simple Exploits Overlooked by Most Bug Hunters intermediate | Easy but Rare Bugs in Bug Bounty Hunting: Uncovering Hidden Gems |
| 2024-12-29 2024 | How to find SSRF, Bypass Cloudflare, and extract AWS metadata intermediate SSRF | I was working on a program and since I have no permission to disclose the name of the target, let’s call it redacted.com. |
| 2024-12-14 2024 | InfoSec Blog intermediate 1 min read | Writeup detailing CVE-2020-13379, an unauthenticated full-read SSRF in Grafana versions 3.0.1-7.0.1 achieved through redirect chaining and URL parameter injection. It also covers AWS Metadata API research, explaining how SSRF can escalate in AWS environments by accessing http://169.254.169.254, and offers beginner resources for aspiring bug bounty hunters. |
| 2024-11-16 2024 | HackTricks Training beginner 3 min read | Training courses offering hands-on labs replicating real-world scenarios for cybersecurity mastery. Paths cater to beginners (Apprentice) and advanced practitioners (Expert), focusing on Red Teaming tactics across cloud environments like AWS, GCP, and Azure. Flexible bundles and corporate discounts are available, with certifications proving skills in detecting, exploiting, and mitigating security flaws. |
| 2024-11-01 2024 | Comprehensive Bug Bounty Hunting Methodology (2024 Edition) beginner | Welcome to your complete bug bounty guide! 🕵️ This is designed for beginners, but even if you’re experienced, there’s always something new… |
| 2024-10-17 2024 | 👩💻 $600k Bounty, Jetty Features, Response Queue Poisoning, Bypass SSRF Protections, XSS… intermediate SSRF | A $600K bounty was awarded due to a business logic flaw in smart contracts. → infosecwriteups.com |
| 2024-10-17 2024 | Story of a 2.5k Bounty — SSRF on Zimbra Led to Dump All Credentials in Clear Text intermediate SSRF | The content discusses a successful bug bounty story where the author and a friend earned approximately $2500 from Cafebazaar by exploiting a Server-Side Request Forgery (SSRF) vulnerability on Zimbra, leading to the exposure of all credentials in clear text. → infosecwriteups.com |
| 2024-10-17 2024 | My First Bug: Blind SSRF Through Profile Picture Upload intermediate SSRF | The content is a writeup detailing the discovery of the author's first bug, which involves a blind Server-Side Request Forgery (SSRF) vulnerability through profile picture upload. The author likely shares their experience, the steps taken to identify the bug, and the impact of the vulnerability. This bug could potentially allow an attacker to manipulate the server into making requests on their behalf, leading to unauthorized access or data leakage. The writeup may also include insights on responsible disclosure and the importance of thorough security testing in web applications. → infosecwriteups.com |
| 2024-10-17 2024 | 10 Types of Web Vulnerabilities that are Often Missed - Labs Detectify beginner 16 min read SSRF | Library detailing common, often-missed web vulnerabilities beyond the OWASP Top 10. It covers HTTP/2 Smuggling, exploiting desyncs between HTTP/2 and HTTP/1.1; XXE via Office Open XML parsers, leveraging XML parsing within document formats like .docx and .xlsx; SSRF via XSS in PDF Generators, by injecting JavaScript into HTML-to-PDF converters to access internal resources; and XSS via SVG files, a persistent issue with image upload functionalities. → labs.detectify.com |
| 2024-10-17 2024 | How i found 3 SSRF in one day on different bug bounty targets. intermediate SSRF | The blog discusses the author's approach to bug bounty targets, detailing how they discovered three Server-Side Request Forgery (SSRF) vulnerabilities within 5-6 hours on different targets. The focus is on their successful identification of SSRF vulnerabilities and the speed at which they were able to find them. |
| 2024-10-17 2024 | BugBounty | A Simple SSRF intermediate 2 min read SSRF | Writeup detailing an SSRF vulnerability discovered in a macOS chat client. The vulnerability arises from the client's preview functionality, which fetches URLs and displays content, including favicons and titles. By crafting specific URLs, including those pointing to internal IP addresses and the `file://` scheme, the author was able to exfiltrate sensitive data. Further analysis revealed the potential for JavaScript execution within the preview, allowing for content retrieval beyond Same Origin Policy restrictions, with a proof-of-concept demonstrating the exfiltration of Google's content length and the suggestion of DNS rebinding as a bypass for stricter SOP enforcement. |
| 2024-10-17 2024 | AWS takeover through SSRF in JavaScript intermediate 7 min read SSRF | Writeup of AWS takeover exploiting a Server-Side Request Forgery (SSRF) vulnerability within a custom JavaScript macro language called Banan++. The `Union()` function, which utilized `eval()` without proper sanitization, was identified as the injection point. By manipulating the `operation` parameter, an attacker could craft malicious Banan++ code to execute arbitrary JavaScript, including making outbound HTTP requests using `fetch()`. This SSRF vulnerability ultimately led to the compromise of AWS credentials and full account takeover, including numerous S3 buckets and EC2 instances. |
| 2024-10-17 2024 | How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE! advanced 6 min read RCE SSRF | Writeup detailing a four-vulnerability exploit chain against GitHub Enterprise, culminating in Remote Code Execution (RCE). The chain begins with bypassing IP restrictions in the `faraday` gem for an initial SSRF. This SSRF is then used to exploit a second SSRF within the Graphite service, forming an SSRF execution chain. A CR-LF injection within this chain allows for protocol smuggling, specifically targeting Memcached with a malicious Marshal object, which triggers RCE upon deserialization. |
| 2024-10-16 2024 | reddelexc/hackerone-reports: Top disclosed reports from HackerOne intermediate 2 min read | Library of disclosed HackerOne reports, featuring top findings categorized by vulnerability type such as XSS, XXE, CSRF, IDOR, RCE, SQLi, SSRF, and business logic flaws. It also ranks reports by program, including Mail.ru, HackerOne, Shopify, Nextcloud, and Twitter. The library is updated using Python 3 scripts that require chromedriver and Chromium executables. |
| 2024-10-15 2024 | Top 13 Vulnerable Web Applications and Websites for Ethical Hacking Practice beginner | This list contains a variety of vulnerable websites, vulnerable web apps, battlegrounds and wargames communities. |
| 2024-10-12 2024 | Secrets and Shadows: Leveraging Big Data for Vulnerability Discovery at Scale advanced 38 min read | Survey of cloud vulnerability discovery techniques, including dangling DNS records and hardcoded secrets, reveals systemic weaknesses in tens of thousands of organizations like Samsung and NVIDIA. This approach identified over 66,000 unique top-level domains with dangling records and more than 15,000 verified API secrets. The research highlights how insecure defaults and incentivized misconfigurations by cloud providers contribute to these vulnerabilities, despite limited customer awareness and insufficient provider accountability. |