The newest Bug Bounty resources are on the Bug Bounty page. For a reading order instead of a date order, see the Bug Bounty learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2023-03-29 2023 | skills/secure-code-game beginner 1 min read AuthZ | Game for learning secure coding practices through an in-editor, browser-based experience. Season 4 focuses on securing Agentic Workflows and Multi-Agent Communications within an AI coding assistant that generates bash commands, browses the web, and orchestrates workflows. Players progress through five difficulty levels without requiring prior AI or coding experience. The game is self-contained per season and readily available in GitHub Codespaces. |
| 2022-10-14 2022 | HTTP-HOST HEADER ATTACKS intermediate | The content discusses HTTP-Host header attacks, a type of security vulnerability where attackers manipulate the host header to exploit web applications. By altering the host header, attackers can bypass security measures, access unauthorized data, or perform other malicious activities. These attacks can be used to trick servers into processing requests differently, potentially leading to data breaches or system compromise. It is crucial for web developers and security professionals to be aware of these vulnerabilities and implement proper security measures to prevent HTTP-Host header attacks. |
| 2022-06-09 2022 | Favorite tweet by @fardeenahmed411 beginner API Sec | Favorite tweet: API Bug-Bounty Tools Check list (Part - 1) - Postman (It is like Burpsuite for API) - APISec - AppKnox - Synopsis API Scanner - Data Theorem API Secure #cybersecuritytips #bugbountyti... |
| 2022-05-24 2022 | Favorite tweet by @0xAsm0d3us beginner | Favorite tweet: Bug Hunter Handbook: a book that contains lists of resources that will help bug bounty hunters with resources that are useful during their bug bounty journey. https://t.co/Db2d6AnxXs ... |
| 2022-05-11 2022 | Favorite tweet by @Nickieyey beginner XSS | Favorite tweet: Top XSS (Cross Site Scripting) Tools : 1) BeeF 2) BlueLotus_XSSReceiver 3) xssor2 4) Xsser-Varbaek 5) Xsser-Epsylon 6) Xenotix #pentesting #ethicalhacking #cybersecurity #CyberSec #we... |
| 2022-04-17 2022 | GitHub - EdOverflow/bugbounty-cheatsheet: A list of interesting payloads, t beginner | Cheatsheet compiling interesting payloads and techniques for bug bounty hunters, emphasizing contributions through the issue tracker and adherence to a Markdown style guide for uniformity. It encourages users to search for existing issues before reporting, advocates for syntax highlighting in code blocks, and suggests specific formatting for titles and subheadings. |
| 2022-04-14 2022 | Favorite tweet by @e11i0t_4lders0n intermediate Burp XSS | Favorite tweet: Burp Extension for XSS Thread 🧵 #bugbounty #bugbountytip #bugbountytips — Tushar Verma 🇮🇳 (@e11i0t_4lders0n) Apr 14, 2022 |
| 2022-04-14 2022 | Favorite tweet by @Jhaddix intermediate AuthZ | Favorite tweet: 🧵Another hacker story thread!🧵 === Penetrating a Porn Site === How I hacked access to the most sensitive areas of a porn site using only low severity vulnerabilities. Here's how I did... |
| 2022-04-09 2022 | Favorite tweet by @Jhaddix intermediate | Favorite tweet: 4/8/22 #bugbountydiary #bugbountytips Everyone is sick in the house but I had some running scans I needed to check up on. I found a SQL injection bug on a blog. Here's how I did it, s... |
| 2022-04-06 2022 | Favorite tweet by @harshbothra_ beginner Recon | Favorite tweet: 14 Payload Repositories to find all the required Payloads & Attack Vectors. 🧵 — Harsh Bothra (@harshbothra_) Apr 1, 2022 |
| 2022-04-06 2022 | Favorite tweet by @hakluke beginner RCE | Favorite tweet: I see people confuse these terms all the time, so I wrote a reference-style blog about it! The difference between code injection, command injection, RCE, remote code execution and rem... |
| 2022-03-23 2022 | Favorite tweet by @imranparray101 beginner API Sec | Favorite tweet: We at @snap_sec recently published a bunch of articles on “Attacking modern web apps” , go check them out. 👇 https://t.co/dwzeO7cGl2 https://t.co/8bpZX25CTL https://t.co/WHT1rreRro ht... |
| 2022-03-19 2022 | Favorite tweet by @NandanLohitaksh beginner Recon | Favorite tweet: Pentest-Book: A collection of some awesome tools or techniques, tricks that might be useful in pentests/bugbounties (by @Six2dez1) #cybersecurity #bughunting #hacking #malware https:/... |
| 2022-03-17 2022 | Favorite tweet by @0xAsm0d3us beginner Recon | Favorite tweet: Pentest-Book: A collection of some awesome tools or techniques, tricks that might be useful in pentests/bugbounties (by @Six2dez1) #cybersecurity #bughunting #hacking #malware https:/... |
| 2022-03-17 2022 | Favorite tweet by @0x1shu beginner Secrets | Favorite tweet: 🧙♂️Git Secrets Leaks Simplified by @sec_r0 ✨ In this flyer, you'll learn about how git works and the reason behind the git secrets leaks. Download the flyer: https://t.co/zMruBpl6c4 ... |
| 2022-03-06 2022 | Favorite tweet by @AnubhavSingh_ beginner Recon | Favorite tweet: Tips and Resources to learn about pentesting 28 Attack Surface by @0xAwali A thread 🧵 ↓ #AppSec #infosec #bugbountytips #Pentesting — Anubhav Singh🇮🇳 (@AnubhavSingh_) Mar 6, 2022 |
| 2022-03-06 2022 | Favorite tweet by @fardeenahmed411 beginner Burp Recon | Favorite tweet: Top 10 essential tools for Bug-Bounty Hunting : 1. Burp Suite / ZAP-Proxy 2. Google Dorking Script 3. DNS-Discovery 4. Reverse IP Lookup 5. Wapiti 6. INalyzer 7. IronWASP 8. Wfuzz 9. ... |
| 2022-03-06 2022 | Favorite tweet by @Sm4rty_ beginner | Favorite tweet: Inspired by @harshbothra_ talk at #IWCON by @InfoSecComm , I finally managed to start a smaller challenge i.e. LEARN101 challenge. I will be posting my daily learning's both over twit... |
| 2022-02-28 2022 | Favorite tweet by @NandanLohitaksh intermediate RCE | Favorite tweet: Top 25 Remote Code Execution (RCE) Parameters 1. ?cmd={payload} 2. ?exec={payload} 3. ?command={payload} 4. ?execute={payload} 5. ?ping={payload} 6. ?query={payload} 7. ?jump={payload... |
| 2022-02-27 2022 | Favorite tweet by @ZAProxyCon beginner Talks | Favorite tweet: You're invited to #ZAPCon 2022! ⚡️ Whether you are just getting started, or have a decade of experience with ZAP, ZAPCon will level-up your AppSec skills. 100% Virtual. 100% Free! 🎟️ ... |
| 2022-01-15 2022 | Must-Have Tools For Hacking beginner Recon | Must-Have Tools For Hacking |
| 2022-01-09 2022 | The Cyber Mentor beginner | The Cyber Mentor |
| 2022-01-03 2022 | BUG BOUNTY HUNTING WITH BURP SUITE beginner Burp | BUG BOUNTY HUNTING WITH BURP SUITE |
| 2021-12-28 2021 | A Summary Of Fancy Attack Injection Methods - Part 1 intermediate | A Summary Of Fancy Attack Injection Methods - Part 1 |
| 2021-12-27 2021 | Awesome Bug Bounty Builder intermediate 4 min read | Tool that automates the discovery and exploitation of web vulnerabilities. It integrates a vast array of reconnaissance and attack tools such as Amass, Sublister, Gauplus, HTTPX, Sqlmap, Commix, Paramspider, Nuclei, and FFUF. The script provides commands for identifying XSS, SQL injection, LFI, SSRF, file upload bypasses, and header injections, along with guidance on WAF bypassing techniques and token extraction. |
| 2021-12-26 2021 | 2014 06 25 minimal viable program intermediate | 2014 06 25 minimal viable program |
| 2021-12-09 2021 | TryHackMe: A Beginners Guide to Getting Started beginner 3 min read | Platform offering hands-on cybersecurity education through gamified challenges and virtual rooms. Users can learn specific skills via "Rooms" or follow structured "Learning Paths" composed of "Modules." Features include vulnerable "Networks" like Throwback, Holo, and Wreath, and competitive "King of the Hill" challenges. The platform uses a points and ranking system, with both free and premium tiers available. |
| 2021-12-06 2021 | Hakluke: Creating the Perfect Bug Bounty Automation intermediate 13 min read | Library for building bug bounty automation frameworks, detailing iterations from simple Bash scripts to a Django application utilizing PostgreSQL and RabbitMQ. This framework enables efficient data storage, modular vulnerability detection through custom management commands, and horizontal scaling with worker instances, inspired by the development of tools like Interlace for concurrent task execution. → labs.detectify.com |
| 2021-11-26 2021 | BBRE Premium intermediate 3 min read | Membership offers bi-weekly articles with hacking tips, tool tutorials, and career advice for bug bounty and web application security professionals. Subscribers gain access to a complete archive of past issues, a private Discord community for collaboration, and hands-on labs for replicating vulnerabilities. The content focuses on advanced offensive security techniques, not OWASP Top 10 basics, and is ideal for those who lack time to comb through conference talks and disclosed write-ups. A 30-day money-back guarantee is included. |
| 2021-11-24 2021 | Install Nuclei beginner 13 min read Recon | Tool for high-performance vulnerability scanning, Nuclei uses simple YAML templates for custom detection scenarios, minimizing false positives through real-world simulation. It supports numerous protocols including HTTP, DNS, and TCP, integrates with CI/CD pipelines, and offers extensive filtering and output options. Installation requires Go version 1.24.2 or later. |
| 2021-11-21 2021 | HTB: BountyHunter intermediate 10 min read Recon | Tool for exploiting XXE vulnerabilities, demonstrated on the HTB: BountyHunter machine. This writeup details how to leverage an XXE flaw in an XML parsing script to read sensitive files like `/etc/passwd` and PHP configuration files. The exploit allows initial shell access, leading to privilege escalation via Python `eval` injection in a root-owned ticket validation script. |
| 2021-11-13 2021 | Web Attack Cheat Sheet intermediate 61 min read API Sec SQLi XSS | Library of web attack techniques and resources, covering enumeration, scanning, payloads, and bypasses for vulnerabilities such as SSRF, XXE, OAuth, SQLi, XSS, Path Traversal, LFI, SSTI, HTTP/SMTP Header Injection, and deserialization. It includes links to tools for ASN lookup, favicon-based IP discovery, CDN IP range identification, and discovering origin IPs for Cloudflare-protected sites. The library also references methods for subdomain enumeration and broader attack surface discovery through various data sources and active reconnaissance. |
| 2021-11-10 2021 | Penetration Testing : Report Writing intermediate | Guide to penetration testing report writing, inspired by OWASP RailGoat. It structures the report process from template creation and findings documentation to executive summaries, attack summaries, optional components, and finalization. Key sections covered include executive summaries, attack walkthroughs, findings with remediation, and value-adds such as graphical analysis and chained issue summaries. The guide references sample reports from public repositories like `juliocesarfort/public-pentesting-reports`. |
| 2021-10-28 2021 | Haklukes Guide to AmassHow to Use Amass More Effectively for Bug Bounties intermediate Recon | Haklukes Guide to AmassHow to Use Amass More Effectively for Bug Bounties |
| 2021-10-25 2021 | Bug Bounty Playbook 2 beginner | Bug Bounty Playbook 2 |
| 2021-10-04 2021 | 10 Types of Web Vulnerabilities that are Often Missed intermediate 16 min read IDOR SQLi SSRF XSS | Reference outlining 10 web vulnerabilities often missed by security testers, including HTTP/2 Smuggling exploiting HTTP/1.1 desyncs, XXE via Office Open XML parsers in document uploads, SSRF through XSS in PDF generators by leveraging headless browser execution, and XSS via SVG file uploads. The entry highlights techniques and considerations for discovering these less-common but impactful attack vectors. → labs.detectify.com |
| 2021-09-15 2021 | My Favorite Pentest Tools (Top 15) intermediate Recon | My Favorite Pentest Tools (Top 15) |
| 2021-09-07 2021 | Automating Authorization Testing: AuthMatrix Part 1 intermediate 2 min read AuthZ | Tool for automating authorization testing, AuthMatrix enables comprehensive security assessments by systematically verifying access controls across applications. This method goes beyond basic penetration testing, focusing on the granular evaluation of user permissions and potential privilege escalation vulnerabilities. → whiteoaksecurity.com |
| 2021-09-07 2021 | AWS Security for Noobs beginner | AWS Security for Noobs |
| 2021-08-30 2021 | Hakluke's huge list of resources for beginner hackers beginner 6 min read Recon | Library: This catalog entry lists curated resources for beginner hackers, covering bug bounty hunting and penetration testing. It highlights platforms like Pentesterlab, Portswigger labs, Tryhackme, Hackthebox, Kontra, Hacker101.com, and Vulnhub for hands-on learning. The entry also recommends YouTube channels and Twitter accounts from established cybersecurity professionals, and lists blogs and write-up platforms such as Hackerone Hacktivity, Crowdstream, and Intigriti for exploring disclosed vulnerabilities and methodologies. → labs.detectify.com |
| 2021-08-21 2021 | The Scariest Things We Saw at Black Hat 2021 news Talks | The Scariest Things We Saw at Black Hat 2021 |
| 2021-07-28 2021 | Chaining password reset link poisoning IDOR and information leakage to achieve account takeover at api.redacted.com advanced AuthZ IDOR | Researchers successfully exploited a critical vulnerability on api.redacted.com, achieving account takeover. The attack involved chaining three distinct vulnerabilities: password reset link poisoning, an Insecure Direct Object Reference (IDOR), and information leakage. By combining these weaknesses, an attacker could potentially gain unauthorized access to user accounts. |
| 2021-07-19 2021 | Finding And Exploiting S3 Amazon Buckets For Bug Bounties intermediate | This content likely discusses how security researchers can find and exploit misconfigured Amazon S3 buckets as part of bug bounty programs. The focus would be on identifying publicly accessible or improperly permissioned buckets that may contain sensitive data or be vulnerable to unauthorized access. The core idea is leveraging S3 misconfigurations for bug bounty hunting. |
| 2021-07-19 2021 | Top 11 extensions to turn your browser into an advance hacking tool intermediate Burp | This content lists eleven browser extensions that can transform a user's browser into an advanced hacking tool. The article highlights tools for various cybersecurity tasks, implying a focus on offensive security capabilities. |
| 2021-06-30 2021 | Web-Application-Pentest-Checklist intermediate API Sec Recon | This document is a comprehensive checklist designed for web application penetration testing. It outlines various areas and techniques to thoroughly assess the security of web applications. The checklist covers crucial aspects such as reconnaissance, vulnerability scanning, authentication and authorization testing, session management, input validation, business logic flaws, and API security. It serves as a systematic guide for pentesters to ensure no critical security weaknesses are overlooked during an engagement, promoting a structured and effective testing methodology. |
| 2021-06-28 2021 | This Is How I Hacked My Neighbors Computer intermediate | |
| 2021-06-14 2021 | Intro to Bug Bounty Hunting and Web Application Hacking beginner | This content introduces bug bounty hunting and web application hacking. It explains the fundamentals of identifying vulnerabilities in web applications, a crucial skill for security professionals and ethical hackers. The goal is to discover and report security flaws, often rewarded with bounties for valid findings. The text provides a foundational understanding of how to approach this field, setting the stage for learning more advanced techniques in identifying and exploiting web application weaknesses. |
| 2021-05-23 2021 | Bug Bounty Bootcamp beginner 4 min read | Book detailing bug bounty hunting from fundamentals to advanced techniques, including Cross-Site Scripting, API hacking, and the use of fuzzers. It offers step-by-step instructions for finding and reporting vulnerabilities, developing testing methodologies, and navigating bug bounty platforms, making it a comprehensive resource for beginners and experienced security professionals alike. |
| 2021-05-18 2021 | If you find powerful OXML XXE tool? it’s “DOCEM” intermediate XXE | The content shares a tool called "DOCEM" for XXE testing, which is more convenient than manually working or using previously available tools. It aims to assist in finding a powerful OXML XXE tool for testing purposes. |
| 2021-05-17 2021 | How to discover up to 10,000 subdomains with your own tool | by _Y000_ | In intermediate | The content discusses creating a tool using bash to discover up to 10,000 subdomains. The tool's development involves programming tasks in bash and breaking them down into parts for better understanding and implementation. → infosecwriteups.com |