bugbounty

A curated list of Smart Contract Security materials and resources For Researchers

These are my checklists which I use during my hunting.

A tool to fastly get all javascript sources/files

The goal of this guide is very simple - to teach anyone interested in cyber security, regardless of their knowledge level, how to make the most of Netlas.io.

An OSINT tool to quickly extract IP and URL endpoints from APKs by disassembling and decompiling

Collection of Facebook Bug Bounty Writeups

⚡ Perform subdomain enumeration using the certificate transparency logs from Censys.

An insane list of all dorks taken from everywhere from various different sources.

Unleash the power of cloud

An automation tool that scans sub-domains, sub-domain takeover, then filters out XSS, SSTI, SSRF, and more injection point parameters and scans for some low hanging vulnerabilities automatically.

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

Bug Bounty Tricks and useful payloads and bypasses for Web Application Security.

An OSINT tool that helps detect members of a company with leaked credentials

A heavily armed customizable phishing tool for educational purpose only

TOP All bugbounty pentesting CVE-2023- POC Exp RCE example payload Things

🔥🔒 Awesome MCP (Model Context Protocol) Security 🖥️

Passive API key and secret discovery browser extension for Chrome and Firefox. 80+ detection patterns, zero config.

Google Dork List - Uncover the Hidden Gems of the Internet ( There are at least 320+ categories ) + Web App

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

A tool to embed XXE and XSS payloads in docx, odt, pptx, xlsx files (oxml_xxe on steroids)

ScanT3r - Module based Bug Bounty Automation Tool ( use Lotus instead github.com/bugBlocker/lotus )

A fast tool to scan client-side prototype pollution vulnerability written in Rust. 🦀

Bug Bounty ~ Awesomes | Books | Cheatsheets | Checklists | Tools | Wordlists | More

Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases.

The classic launcher, evolved. Fast, Go-based command library equipped with 200+ cybersecurity cheat-sheets. Just install and start hacking.

Practical resources for offensive CI/CD security research. Curated the best resources I've seen since 2021.

🧿 AutorizePro是一款强大越权检测 Burp 插件，通过增加 AI 辅助分析 && 进一步优化检测逻辑，大幅降低误报率，提升越权漏洞检出效率。 [ AutorizePro is a authorization enforcement detection extension for burp suite. By adding Ai-assisted analysis, it significantly reduces the false positive rate and improves the efficiency of vulnerability detection.

Passive leak enumeration tool.

GitHub Attack Toolkit - Extreme Edition - A static analysis and exploit toolkit for GitHub Actions.

Web App bug hunting