Notes
Search…
Notes
Resources
Web PenTesting / Bug Bounty
Bug Bounty Methodology
XSS
XXE
Exploit Development / BoF
Pwntools
Buffer Overflows
Powered By GitBook
Bug Bounty Methodology

List of valuable bug program managers:

Bugcrowd
https://www.bugcrowd.com/
​
Hackerone
https://www.hackerone.com/
​
Synack
https://www.synack.com/
​
Japan Bug bounty Program
https://bugbounty.jp/
​
Cobalt
https://cobalt.io/
​
Zerocopter
https://zerocopter.com/
​
Hackenproof
https://hackenproof.com/
​
BountyFactory
https://bountyfactory.io
​
Bug Bounty Programs List
https://www.bugcrowd.com/bug-bounty-list/
​
AntiHack
https://www.antihack.me/

What to read?

OWASP Testing Guide
https://owasp.org/www-project-web-security-testing-guide/stable/
​
The Web Application Hacker's Handbook
https://www.amazon.com/gp/product/1118026470/ref=as_li_tl?ie=UTF8&camp=1789&creative=9325&creativeASIN=1118026470&linkCode=as2&tag=bugcrowd-20&linkId=9f9c5e3f51e50ea7092a21a04aec184f/

Cheatsheets

https://github.com/EdOverflow/bugbounty-cheatsheet

Tips

Bug Bounty Hunting Tip #1- Always read the Source Code
Bug Bounty Hunting Tip #2- Try to Hunt Subdomains
Bug Bounty Hunting Tip #3- Always check the Back-end CMS & backend language (builtwith)
Bug Bounty Hunting Tip #4- Google Dorks is very helpful
Bug Bounty Hunting Tip #5- Check each request and response

Approach

- First review the scope
- Perform reconnaissance to find valid targets
- Find sub-domains through various tools Sublist3, virus-total etc.
- Select one target then scan against discovered targets to gather additional information (Check CMS, Server and all other information which i need)
- Use google dorks for information gathering of a particular taget.
- Review all of the services, ports and applications.
- Fuzz for errors and to expose vulnerabilities
- Attack vulnerabilities to build proof-of-concepts

Powerful google dorks

* “index of” “windows” “iso” site:.edu
* ite:.eu responsible disclosure
* inurl:index.php?id=
* site:.nl bug bounty
* “index of” inurl:wp-content/ (Identify Wordpress Website)
* inurl:”q=user/password” (for finding drupal cms )

Tools

* Information gathering
RED-HAWK (All-in-one)
https://github.com/Tuhinshubhra/RED_HAWK
​
* Subdomain lookup
Sub.sh (Hunting + Alive check)
https://github.com/cihanmehmet/sub.sh
​
Sublistr (Recursive check sub.sub.website.com)
https://github.com/aboul3la/Sublist3r
​
* Subdomain takeover check
Subzy
https://github.com/LukaSikic/subzy
​
Subjack
https://github.com/haccer/subjack.git
​
* Alive check-up
Httprobe
https://github.com/tomnomnom/httprobe
​
* SQLi + Wayback
WaybackSqliScanner
https://github.com/ghostlulzhacks/waybackSqliScanner
​
WaybackURLs
https://github.com/tomnomnom/waybackurls
​
* ! Open Threat Exchange Search
Gau
https://github.com/lc/gau
​
* Multi-tool
Hakrawler
https://github.com/hakluke/hakrawler
​
* Broken link checker
https://github.com/stevenvachon/broken-link-checker
` blc -r –filter-level 2 https://starbucks.com | grep “\.js” | grep “BROKEN”`

Search engines

https://domainbigdata.com/
​
https://censys.io
​
https://shodan.io
​
https://viz.greynoise.io
​
https://zoomeye.org
​
https://netograph.io
​
https://wigle.net
​
https://intelx.io
​
https://fofa.so
​
https://hunter.io
​
https://haveibeenpwned.com

Blog links

API Exploitation:
http://ghostlulz.com/swagger-api/
​
XXE
http://ghostlulz.com/xml-external-entityxxe/
​
Broken link hijacking
http://ghostlulz.com/broken-link-hijacking/
Previous
Resources
Next - Web PenTesting / Bug Bounty
XSS
Last modified 2yr ago
Copy link
Outline
List of valuable bug program managers:
What to read?
Cheatsheets
Tips
Approach
Powerful google dorks
Tools
Search engines
Blog links