A concise, practical reference for authorized web security research and bug bounty hunting. Covers recon pipelines, 14 vulnerability classes, API/mobile testing, WAF bypass, reporting, and tooling — each with ASCII diagrams, payloads, techniques, and per-vuln tool tables.
Authorization required. Only test systems you have explicit written permission to access. Bug bounty programs define this scope. Violating scope is unauthorized access regardless of intent.
| File | Description |
|---|---|
bug_bounty_guide.md |
Full field guide — techniques, payloads, diagrams, tools |
summary.md |
One-page quick reference — cheatsheet, commands, report checklist |
bug_bounty_guide.pdf |
PDF export of the full guide |
summary.pdf |
PDF export of the quick reference |
1. Mindset & Setup — platforms, workspace layout
2. Reconnaissance — passive OSINT, Google dorks, active recon
3. Subdomain & Asset Enum — pipeline, subdomain takeover
4. Web Application Testing — attack surface map, Burp workflow
5. Vulnerability Classes — 14 classes with payloads + tools
5.1 XSS 5.8 Authentication & JWT
5.2 SQL Injection 5.9 Path Traversal / LFI
5.3 SSRF 5.10 RCE
5.4 IDOR 5.11 CSRF
5.5 XXE 5.12 CORS Misconfiguration
5.6 Open Redirect 5.13 Insecure Deserialization
5.7 SSTI 5.14 Prototype Pollution
6. API & Mobile Testing — REST, GraphQL, Android/iOS (apktool, Frida, objection)
7. Business Logic Flaws — race conditions, price manipulation, workflow bypass
8. Reporting — CVSS severity, report template, writing tips
9. Tools Reference — full toolkit, Nuclei quick reference + template example
10. WAF Bypass — encoding, SQLi/XSS obfuscation, header tricks, chunked TE
11. Resources & Practice — labs, writeup sites, communities, learning path
# 1. Subdomain recon
subfinder -d target.com | httpx -title -sc -o live.txt
# 2. Vulnerability scan
nuclei -l live.txt -severity critical,high -o vulns.txt
# 3. Directory fuzz
ffuf -u https://target.com/FUZZ \
-w /opt/SecLists/Discovery/Web-Content/raft-large-words.txt \
-mc 200,301,302,403| Vuln | Detect | Exploit |
|---|---|---|
| XSS | dalfox, XSStrike | DOM Invader, XSSHunter |
| SQLi | sqlmap, Nuclei | sqlmap --dump, Ghauri |
| SSRF | ffuf, Nuclei | SSRFmap, Gopherus |
| IDOR | Burp Autorize | Repeater (manual) |
| XXE | Burp Suite | XXEinjector |
| Open Redirect | OpenRedireX, gf | Chained OAuth token theft |
| SSTI | tplmap, SSTImap | tplmap --os-shell |
| Auth/JWT | jwt_tool | hashcat, Burp JWT Editor |
| Path Traversal | dotdotpwn, LFImap | LFImap auto-exploit |
| RCE | commix, Nuclei | Metasploit, weevely |
| CSRF | Burp Scanner, Nuclei | Burp CSRF PoC generator |
| CORS | corsy, Nuclei | JS cross-origin fetch PoC |
| Deserialization | Nuclei, Burp ext. | ysoserial, PHPGGC |
| Proto. Pollution | ppfuzz | Manual __proto__ injection |
Educational and authorized security research use only.