top of page

Bug Bounty Tools

#Methodology

​​

#Resources

#Bug Bounty References

#Report Writing and Note Taking

​​

#Operating System Setups

​

#WEAREHACKERONE Email Addresses for use on HackerOne (creating accounts on targets, ideal for IDOR's)

​

#Anonymity

#Code Editors

#OWASP Web Security testing Guide

#Autonomous System Numbers

#Azure

  • azurehound - BloodHound data collector for Microsoft Azure


#Subdomain Finders

  • subfinder - Find subdomains

  • sublist3r - Subdomain enumeration

  • dnsgen - Subdomain discovery

  • chaos - Subdomain enumeration

  • github - Subdomains

  • assetfinder - Find domains and subdomains

  • Rubikrecon - Bug Bounty and Reconnaissance tool designed to automate various tasks involved in the reconnaissance phase of security testing and bug bounty hunting

  • subranger - Subdomain finder

  • Knock - Enumerate subdomains

  • findomain - Find subdomains


#Domain Flyovers

  • aquatone - Domain flyovers


#Subdomain takeovers

  • NtHiM - Subdomain takeovers, must add export PATH=/home/unknown/.cargo/bin:$PATH to .bashrc fileif .bashrc file corrupts - cp ~/.bashrc ~/.bashrc.bak cp /etc/skel/.bashrc ~/ source ~/.bashrc

  • takeover.py - Sub-Domain TakeOver Vulnerability Scanner

  • subzy - Subdomain takeover tool

  • tko-subs - Check subdomain takeover

  • https://www.youtube.com/watch?v=CCICEKuYchw


#Vulnerability Scanner

  • nuclei - Vulnerability Scanner

  • dirsearch - Web Path Scanner

  • sn1per - Discover hidden assets and vulnerabilities in your environment

​​​​

#Wordlists

​​

#Web Proxy

#Port Scanner

  • naabu - Port Scanner

  • rustscan - Modern Port Scanner

  • nmap - Port Scanner

  • smap - Port Scanner


#Web Scanners

  • whatweb - Website Identifier

  • jaeles - Build your own web app scanner


#Web Brute Forcer

  • gobuster - Command-line tool used for brute-forcing hidden paths on web servers


#Web Content Scanner

  • dirb - Web Content Scanner

  • https-toolkit - httpx toolkit

  • gospider - Web Spider

  • hakrawler - Web Crawler

  • nikto - Web Application Scanner

  • bbot - internet scanner

  • httprobe - Take a list of domains and probe for working http and https servers

  • httpx - Fast and multi-purpose HTTP toolkit

  • aquatone - Visual inspection of websites

  • katana - Web Crawler

  • whatruns - A free browser extension that helps you identify technologies used on any website


#Content Discovery

  • kiterunner - Content discovery

  • amass - Attack surface mapping and asset discovery

​​​

#Shodan Enumeration

  • shosubgo - Small tool to Grab subdomains using Shodan api


#GITHUB Enumeration

#Template Injection

  • Tinja - CLI tool for testing web pages for template injection


#CRLF

  • crlfuzz - Fast tool to scan CRLF vulnerability


#Javascript

  • LinkFinder - Javascript endpoints

  • SecretFinder - Discover sensitive data like apikeys, accesstoken, authorizations, jwt,..etc in JavaScript files

  • xnlinkfinder - Discover endpoints (and potential parameters) for a given target

  • getJS - Javascript links

  • Relative URL Extratcor - git clone https://github.com/jobertabma/relative-url-extractor

  • GoLinkFinder -  go install github.com/0xsha/GoLinkFinder@latest


#DNS Recon

  • dig

  • dnsrecon

  • massdns - High-performance DNS stub resolver


#403 Bypass

​​

#Wayback

  • waybackurls - Archived websites

  • webanalyze - Wappalyzer

  • waymore - Web archive scanner

  • getallurls - getallurls (gau) fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, Common Crawl, and URLScan for any given domain. Inspired by Tomnomnom's waybackurls

​​​

#XSS Finders

  • xsssniper - Handy xss discovery tool

  • Dalfox - Scan for XSS flaws and analyzing parameters

​​​

#Web Fuzzer

  • ffuf - Web fuzzer

  • wfuzz - Web application bruteforcer

  • feroxbuster - Tool designed to perform Forced Browsing

​

#SQLi Scanner

  • sqlmap


#Misc

  • jq

  • lolcat

  • figlet

  • Interlace - Turn single threaded command line applications into a fast, multi-threaded application

  • scopify - Analyze infrastructure information

  • cvemap - go install github.com/projectdiscovery/cvemap/cmd/cvemap@latest

  • anew - Append lines from stdin to a file

  • CloudRecon - Finding assets from certificates

  • csrf poc generator –

  • unfurl - Pull out bits of URLs provided on stdin

  • check_mdi.py - Find exchange based apex domains

  • karma v2 - Publicly exposed leaks and many more about their target

  • Spiderfoot - Gather information

  • oniux - https://blog.torproject.org/introducing-oniux-tor-isolation-using-linux-namespaces

  • postMessage-tracker - https://github.com/fransr/postMessage-tracker

  • Postman - curl -o- "https://dl-cli.pstmn.io/install/linux64.sh" | sh

  • Meg - go install github.com/tomnomnom/meg@latest

  • Gowitness - Website screenshot utility

  • bat - cat enhancement

​​

#Language Installers

​​

  • go

  • pip

  • pipx

  • python3-setuptools

  • cargo

  • ruby-full

  • python-dnspython

  • git

bottom of page