Please enable JavaScript.

Coggle requires JavaScript to display documents.

Bug Bounties - Coggle Diagram

- - - - The API aspect of Bug Bounty hunting will be one of the biggest categories since so many types of projects use
        an API. If you understand how they work, where you should focus, and how you can assess them, then you can hunt on most of the different types of proj.
- - - - Httprobe https://github.com/tomnomnom/httprobe
        takes a list of domains/subdomains & return those that have HTTP or HTTPS server available
      - LazyS3 (https://github.com/nahamsec/lazys3)
        S3 are prone to access control misconfigurations, and this tool will help you in finding S3 buckets for your target.
      - HostileSubBruteforcer https://github.com/nahamsec/HostileSubBruteforcer
        This tool will return information such as the IP address and the host, as well as if the subdomain is vulnerable to a subdomain takeover attacker.
      - Meg (https://github.com/tomnomnom/meg)
        Meg will test various paths on a multitude of hosts. With just one tool, you can collect a bounty for all the domains where the path can be found
      - AssetFinder https://github.com/tomnomnom/assetfinder
        This tool will gather information from different sources, such as archives like the Wayback machine and crt.sh, to extract all the unique domains and subdomains that can be found
      - Seltzer (https://github.com/10goto20/seltzer)
        This tool will launch a headless version of the BurpSuite built-in scanner nd use it to perform scans on a list of URLs or domains. This allows you to incorporate Burp Suite’s powerful active scanner into your automated workflow.
    - - JSParser (https://github.com/nahamsec/JSParser)
      - crtndstry (https://github.com/nahamsec/crtndstry)
      - JS-Scan https://github.com/tomnomnom/JS-Scan
    - - Lazyrecon (https://github.com/nahamsec/lazyrecon)
        combines many tools to be as complete as possible. The goal of the tool is to cover as much of the recon phase as possible, hence the name LazyRecon. The tool goes through several phases where it will use one or more existing tools to complete the job
      - OneForAll (https://github.com/shmilylty/OneForAll/blob/master/docs/en-us/README.md)
        the ultimate domain scanner. It combines dozens of different scanners to find all available subdomains and provides its output in an easy to process json or CSV file
      - xElkomy (https://github.com/xElkomy/Workflow-Bug-Bounty)
        EnumX is a script that combines several scanners such as Sublist3r, AssetFinder, HTTProbe, SubJack, Aquatone, and more
    - - Bug Bounty Cheat Sheet (https://github.com/EdOverflow/bugbounty-cheatsheet)
      - WebHackersWeapons (https://github.com/hahwul/WebHackersWeapons
      - Awesome Bugbounty Writeups (https://github.com/devanshbatham/Awesome-Bugbounty-Writeups)
      - bbht (https://github.com/nahamsec/bbht)
      - Recon Profile (https://github.com/nahamsec/recon_profile