Bug Bounty learning path

Orientation and first principles — what the bug class is and how it behaves.

1. Top Vulnerabilities for Pentest & Bug Bounty in 2025
   7 min readnahamsec.com2026
   Library of advanced web security techniques for bug bounty hunters in 2025, focusing on vulnerabilities beyond basic payloads. It details methodologies for Cross-Site Scripting (XSS), including blind XSS and cross-domain implications, and Server-Side Request Forgery (SSRF), emphasizing in-depth analysis of application functionality and local environment replication, advising against tools like Burp Collaborator for testing. The resource also covers Path Traversal, stressing URL encoding mastery and API call testing, and Web Cache Deception, highlighting the identification of sensitive data endpoints, testing file extensions, and analyzing caching headers for exploitation opportunities.
2. [tl;dr sec] #337 - Harnessing Harnesses, Generate Decoy Environments, Bug Bounty Singularity
   10 min readtldrsec.com2026
   Library for building AI-powered vulnerability finding harnesses, programmatically constructing complex decoy cloud environments, and developing autonomous bug bounty hackbots. The entry also discusses a practical guide to threat modeling, limitations in migrating AWS CloudTrail Lake to CloudWatch, and a deception engine for generating realistic cloud decoy environments.
3. Fix Your Bug Bounty Strategy: The 2026 Blueprint
   12 min readcodelivly.com2026
   Library for strategic bug bounty hunting, this resource details a 2026 blueprint to overcome common pitfalls like "spray and pray" tactics and tool overload. It emphasizes a surgeon-like mindset focusing on depth over breadth, automating intelligence gathering, and understanding application logic through the "Asset DNA" model. The framework's three pillars include hyper-targeted recon focusing on functionality and change detection, mastering a specific attack vector, and using automation to build intelligent workflows rather than just discovery. It suggests techniques for identifying vulnerable areas by reverse-engineering business logic and prioritizing new code for testing.
4. Full Bug Bounty Hunting Methodology - Recon (DEF CON 32 Workshop)
   28 min readgithub.com2026
   Workshop slides from DEF CON 32 detailing a bug bounty hunting methodology, focusing on comprehensive reconnaissance. The approach outlines techniques for discovering apex domains using web scraping, Google dorking, and ASN queries, then expands to subdomain enumeration via tools like Amass, brute-forcing with ShuffleDNS, and link discovery. It emphasizes identifying unique attack vectors, including injection and logic flaws, by systematically probing the target's attack surface.
5. Awesome Bug Bounty Tools - GitHub
   27 min readgithub.com2026
   Library of curated bug bounty tools for identifying vulnerabilities such as Command Injection, CORS Misconfiguration, Directory Traversal, Insecure Deserialization, and SQL Injection. This repository includes numerous subdomain enumeration utilities like Sublist3r, Amass, and Findomain, alongside port scanners like masscan and RustScan, and web screenshotting tools like EyeWitness and gowitness. It also features technology identification tools such as Wappalyzer and whatweb, and content discovery tools like gobuster and feroxbuster.

Real testing methodology, tooling, and writeups that show the work.

1. GraphQL - PortSwigger Lab Writeup
   2 min readpy-us3r.github.io2026
   Writeup detailing GraphQL vulnerabilities and exploitation techniques. It covers bypassing introspection query regex validation, brute-forcing logins using aliases to circumvent rate limiting, and performing CSRF by converting requests to `x-www-form-urlencoded`. The entry also demonstrates how to find hidden GraphQL endpoints using directory fuzzing with Gobuster.
2. shuvonsec/claude-bug-bounty: AI Bug Bounty Framework
   5 min readgithub.com2026
   Framework that transforms Claude Code into an AI bug bounty hunting partner, automating target reconnaissance, vulnerability scanning and validation, and professional report generation. It remembers past findings for improved efficiency, offers an autonomous hunting mode, and integrates with platforms like HackerOne and Bugcrowd. The framework includes specialized agents for various tasks and supports scanning for both Web2 and Web3 vulnerabilities, as well as GitHub Actions security.
3. HTB: BountyHunter
   10 min read0xdf.gitlab.io2021
   Tool for exploiting XXE vulnerabilities, demonstrated on the HTB: BountyHunter machine. This writeup details how to leverage an XXE flaw in an XML parsing script to read sensitive files like `/etc/passwd` and PHP configuration files. The exploit allows initial shell access, leading to privilege escalation via Python `eval` injection in a root-owned ticket validation script.
4. Hakluke: Creating the Perfect Bug Bounty Automation
   13 min readlabs.detectify.com2021
   Library for building bug bounty automation frameworks, detailing iterations from simple Bash scripts to a Django application utilizing PostgreSQL and RabbitMQ. This framework enables efficient data storage, modular vulnerability detection through custom management commands, and horizontal scaling with worker instances, inspired by the development of tools like Interlace for concurrent task execution.
5. I ran a paid bug-bounty-style game against my own multimodal prompt firewall, it didn't make money, so here's the code, the model and 13k real bypass attempts
   2 min readhuggingface.co2026
   Library for a multimodal prompt firewall, the Bordair Detector, which acts as a runtime guardrail for LLM inputs. This DeBERTa-v3-large model, fine-tuned as a binary classifier and exported to ONNX for CPU inference, targets task hijacking rather than harmful content. It processes user messages, RAG chunks, tool outputs, and text from uploaded media. The library includes over 500,000 labeled samples and real-world bypass attempts, with weights released under Apache-2.0.

Novel research, edge cases, and the techniques that push the class forward.

1. Intigriti: Exploiting JWT vulnerabilities — advanced exploitation guide
   11 min readintigriti.com2026
   Guide detailing advanced exploitation techniques for JSON Web Tokens (JWTs), covering vulnerabilities arising from misconfigurations and improper input validation. It explains how flaws in handling the 'none' algorithm, missing signature validation, algorithm confusion attacks, and JWK spoofing (including CVE-2018-0114) can lead to authentication bypasses and injection attacks, emphasizing the importance of secure implementation practices.
2. How I Chained 4 vulnerabilities on GitHub Enterprise, From SSRF Execution Chain to RCE!
   6 min readblog.orange.tw2024
   Writeup detailing a four-vulnerability exploit chain against GitHub Enterprise, culminating in Remote Code Execution (RCE). The chain begins with bypassing IP restrictions in the `faraday` gem for an initial SSRF. This SSRF is then used to exploit a second SSRF within the Graphite service, forming an SSRF execution chain. A CR-LF injection within this chain allows for protocol smuggling, specifically targeting Memcached with a malicious Marshal object, which triggers RCE upon deserialization.
3. A Deep Dive into the GetProcessHandleFromHwnd API
   14 min readprojectzero.google2026
   Library exploring the `GetProcessHandleFromHwnd` API, tracing its evolution from an `oleacc.dll` function utilizing window hooks and shared memory for handle duplication in Vista, to a `win32kfull.sys` kernel function (`NtUserGetWindowProcessHandle`) in Windows 10. This analysis reveals discrepancies between API documentation and actual implementation, including changes to UI Access requirements and the move to direct kernel-level process opening, impacting how UAC bypasses and inter-process communication are handled.
4. Secrets and Shadows: Leveraging Big Data for Vulnerability Discovery at Scale
   38 min readbilldemirkapi.me2024
   Survey of cloud vulnerability discovery techniques, including dangling DNS records and hardcoded secrets, reveals systemic weaknesses in tens of thousands of organizations like Samsung and NVIDIA. This approach identified over 66,000 unique top-level domains with dangling records and more than 15,000 verified API secrets. The research highlights how insecure defaults and incentivized misconfigurations by cloud providers contribute to these vulnerabilities, despite limited customer awareness and insufficient provider accountability.
5. Acquiring Malicious Browser Extension Samples on a Shoestring Budget
   11 min readpberba.github.io2024
   Library for acquiring malicious browser extension samples using free resources, including cryptanalysis of obfuscated PowerShell scripts. It details techniques for finding initial samples via services like urlscan and MalwareBazaar, then pivots to acquiring and decrypting newer samples by analyzing file structures and performing XOR key and substitution mapping recovery. The library provides a practical approach to obtaining such samples without enterprise-level tools.
6. Midnight Blizzard attack on Microsoft corporate environment: a detailed analysis, detections and recommendations
   9 min readwiz.io2026
   Analysis of the Midnight Blizzard attack on Microsoft's corporate environment details the APT29 actors' exploitation of a legacy, non-production test tenant account lacking MFA. The attackers leveraged OAuth applications, specifically abusing the `Directory.ReadWrite.All`, `RoleManagement.ReadWrite.Directory`, `Application.ReadWrite.All`, and `AppRoleAssignment.ReadWrite.All` MS Graph permissions, to create a new global administrator user within the production tenant. This allowed them to grant elevated `full_access_as_app` permissions to new malicious OAuth applications, ultimately compromising corporate mailboxes through techniques including password spraying and illicit consent.
7. Advanced Techniques & Use Cases of Nuclei for Bug Bounty
   osintteam.blog2026
   Advanced Techniques & Use Cases of Nuclei for Bug Bounty
8. How to turn SQL injection into an RCE or a file read? Case study of 128 bug bounty reports
   youtube.com2023
   The content discusses techniques for exploiting SQL injection vulnerabilities to achieve Remote Code Execution (RCE) or read files. It presents a case study based on 128 bug bounty reports, providing insights into the process of leveraging SQL injection for more severe attacks. The video likely delves into practical examples, demonstrating how attackers can escalate the impact of SQL injection vulnerabilities to gain unauthorized access or execute malicious code on a target system.