KingOfBugBountyTips - Our main goal is to share tips from some well-know

项目说明

<di="center">

KingOfBugBountyTips

<img src=" width="500" alt="Tactical Recon">

The Ultimate Bug Bounty Reconnaissance Arsenal

*"In the shadows we hunt, in the 代码 we trust"*

---

![Stars]()
![Forks]()
![Last Commit]()

---

| Twitter | YouTube | LinkedIn

</div>

---

DoD

> DoD Disclosure Program | KingRecon DOD

<details>
<summary><b>Full DoD Scope - 19 Domains</b></summary>

| Military Branches | DoD Agencies | Support Commands |
|:-----------------|:-------------|:-----------------|
| *.af.mil - Air Force | *.pentagon.mil - Pentagon HQ | *.dtic.mil - Tech Info Center |
| *.army.mil - Army | *.osd.mil - Office of SecDef | *.dau.mil - Acquisition Univ |
| *.marines.mil - Marines | *.disa.mil - Defense Info Systems | *.health.mil - Military Health |
| *.navy.mil - Navy | *.dtra.mil - Threat Reduction | *.ng.mil - National Guard |
| *.spaceforce.mil - Space Force | *.dla.mil - Logistics Agency | *.uscg.mil - Coast Guard |
| *.ussf.mil - Space Force | *.dcma.mil - Contract Management | *.socom.mil - Special Operations |

</details>

---

Security Notice

> This repository is for EDUCATIONAL and AUTHORIZED testing ONLY.
> Always obtain proper authorization before testing.

<details>
<summary><b>📜 Click to read our Security Policy & Guidelines</b></summary>

<br>

✅ Permitted Use Cases

❌ Prohibited Acti

📋 Responsible Disclosure Guidelines

1. Read the Program Policy - Always review scope and rules
2. Test Safely - Don't cause harm to production systems
3. Document E - Keep detailed notes of your findings
4. Report Pri - Use official channels for disclosure
5. Give Time to Fix - Allow reasonable time to patch
6. Be Professional - Maintain ethical standards

🔒 Report Security Issues

Found a security issue in this repository? Please report it responsibly:

![Report Issue]()

</details>

---

📚 Table of Contents

<details>
<summary><b>Click to expand na</b></summary>

| Section | Description |
|:--------|:------------|
| About | Project o and goals |
| Quick Start | Get started in 5 minutes |
| Required Tools | Essential toolset |
| BBRF Scope DoD | DoD scope configuration |
| Subdomain Enumeration | Finding subdomains |
| Ja Recon | JS file analysis |
| XSS Detection | Cross-site scripting |
| SQL Injection | SQLi techniques |
| SSRF & SSTI | Ser attacks |
| Web Crawling | Deep crawling methods |
| Parameter Discovery | Hidden params |
| Content Discovery | Sensiti |
| Nuclei Scanning | Automated scanning |
| API Security Testing | API |
| Cloud Security | AWS, GCP, Azure |
| Automation Scripts | Ready-to-use scripts |
| Bash Functions | Shell productivity |
| New Oneliners 2026 | C exploits & techniques |
| Oneliners 2024-2025 | Previous techniques |
| February 2026 C | Latest C oneliners |
| Search Engines | Hacker search engines |
| Wordlists | Best wordlists |
| Resources | Books, courses, blogs |

</details>

---

🎯 About

<di="center">

</div>

Our main goal is to share tips from well-known bug hunters. Using ad recon methodology, we disco, APIs, tokens, and that are exploitable. We aim to influence and educate the community with powerful one-liner techniques for better understanding and faster results.

🏆 What Makes This Repository Special?

<table>
<tr>
<td align="center" width="25%">
<img src=" alt="Oneliners"><br>
<b>💎 Curated Commands</b><br>
_{Battle-tested from real hunters}
</td>
<td align="center" width="25%">
<img src=" alt="Methodology"><br>
<b>🎯 Full Methodology</b><br>
_{Recon to exploitation}
</td>
<td align="center" width="25%">
<img src=" alt="Updated"><br>
<b>🔄 Constantly Updated</b><br>
_{New techniques weekly}
</td>
<td align="center" width="25%">
<img src=" alt="Community"><br>
<b>🌍 Community Driven</b><br>
_{Top hunters worldwide}
</td>
</tr>
</table>

📦 Special Resources

<di="center">

![BugBuntu]()
![KingRecon]()
![Contribute]()

</div>

📊 Repository Highlights

<details>
<summary><b>📈 Click to see detailed statistics</b></summary>

<br>

| Category | Count | Status |
|:---------|:-----:|:------:|
| One-Liners | 400+ | ✅ Active |
| Techniques | 50+ | ✅ Active |
| Tools Covered | 100+ | ✅ Active |
| C | 20+ | ✅ Active |
| DoD Domains | 19 | ✅ Active |
| Contributors | Growing | 🚀 Growing |
| Last Update | 2026 | ✅ Current |

</details>

---

🚀 Quick Start

<di="center">

⚡ Get your first recon running in under 5 minutes

</div>

<table>
<tr>
<td width="33%" align="center">
<h3>1️⃣ Install Tools</h3>
<img src=" alt="Time">
</td>
<td width="33%" align="center">
<h3>2️⃣ Run Recon</h3>
<img src=" alt="Time">
</td>
<td width="33%" align="center">
<h3>3️⃣ Find Bugs</h3>
<img src=" alt="Time">
</td>
</tr>
</table>

<details>
<summary><b>🎬 Want a complete automated workflow? Click here!</b></summary>

<br>

</details>

<di="center">

🎯 Pro Tips for Beginners

| Tip | Description |
|:---:|:------------|
| 🔑 | Always get proper authorization before testing |
| 📝 | Keep detailed notes of your findings |
| 🛠️ | Start with automated tools, then manual testing |
| 💰 | Focus on high-impact first |
| 🤝 | Join the community and learn from others |

</div>

---

🛠️ Required Tools

<details>
<summary><b>Click to expand complete 工具 list</b></summary>

Core Tools

| Category | Tools | Installation |
|:--------:|:------|:-------------|
| Subdomain | Subfinder, Amass, Assetfinder, Findomain, Chaos | go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder |
| HTTP Probing | Httpx, Httprobe | go install github.com/projectdiscovery/httpx/cmd/httpx |
| Crawling | Katana, Gospider, Hakrawler, Cariddi | go install github.com/projectdiscovery/katana/cmd/katana |
| URLs | Gau, Waybackurls, Waymore | go install github.com/lc/gau/v2/cmd/gau |
| Scanning | Nuclei, Jaeles, Naabu | go install github.com/projectdiscovery/nuclei/v3/cmd/nuclei |
| XSS | Dalfox, XSStrike, Kxss, Airixss | go install github.com/hahwul/dalfox/v2 |
| SQLi | SQLMap, Ghauri | pip install sqlmap ghauri |
| Utilities | Anew, Qsreplace, Unfurl, Gf, Uro | go install github.com/tomnomnom/anew |
| Fuzzing | Ffuf, Feroxbuster | go install github.com/ffuf/ffuf/v2 |
| JS Analysis | Subjs, LinkFinder, SecretFinder, Jsubfinder | go install github.com/lc/subjs |
| Cert Monitoring | Certstream, Certstream-go | pip install certstream |
| DNS | Dnsx, Shuffledns, PureDNS, MassDNS, Dnsgen | go install github.com/projectdiscovery/dnsx/cmd/dnsx |
| Reverse DNS | Hakrevdns, Prips | go install github.com/hakluke/hakrevdns |
| API Discovery | Arjun, x8, ParamSpider | pip install arjun |
| Screenshots | Gowitness, Eyewitness | go install github.com/sensepost/gowitness |
| Cloud | AWS CLI, CloudEnum, S3Scanner | pip install awscli |
| OSINT | Shodan CLI, Censys, Metabigor | pip install shodan censys |
| Git Recon | Trufflehog, Gitrob, Github-Subdomains | go install github.com/trufflesecurity/trufflehog/v3 |
| Scope Management | BBRF | pip install bbrf |

System Dependencies

Go En Setup

Quick Install Script - Go Tools

Quick Install Script - Python Tools

Quick Install Script - Rust Tools (Feroxbuster)

Quick Install Script - External Tools

Master Install Script (All-in-One)

Wordlists Installation

Installation

</details>

---

🎯 BBRF Scope DoD

---

💀 Subdomain Enumeration ☠️

<di="center">

☠️ ENUMERATE E ☠️

</div>

💀 Multi-Source Discovery (All-in-One)

💀 Certificate Transparency Logs

💀 Certstream Real-Time Monitoring - Basic

💀 Certstream with Domain Filter

💀 Certstream to Subdomain Discovery

💀 Certstream + httpx Li

💀 Certstream Phishing Detection

💀 Certstream with Nuclei Auto-Scan

💀 Certstream Mass Collector Script

💀 Certstream Wildcard Certificate Hunter

💀 Certstream + Shodan Enrichment

💀 Certstream JSON Logger with Timestamp

💀 Certstream Bug Bounty Scope Monitor

💀 Shodan + Nuclei Pipeline

💀 Clawdbot Discovery (Mass Exploitation)

#### ⚡ 1. Find Clawdbot Instances - Basic Search

#### ⚡ 2. Clawdbot HTTP Headers Discovery

#### ⚡ 3. Clawdbot User-Agent Detection

#### ⚡ 4. Clawdbot + Nuclei Exploitation Pipeline

#### ⚡ 5. Clawdbot Ser

#### ⚡ 6. Clawdbot ASN Distribution Analysis

#### ⚡ 7. Clawdbot Geographic Distribution

#### ⚡ 8. Clawdbot + Port Range Scan

#### ⚡ 9. Clawdbot SSL Certificate Analysis

#### ⚡ 10. Clawdbot Realtime Monitor + Alert

💀 ASN Discovery & Reverse DNS

💀 DNS Bruteforce with Shuffledns

💀 Recursi Enum

💀 Passive DNS - Multiple Sources

💀 GitHub Subdomain Scraping

💀 Censys Subdomain Discovery

💀 SecurityTrails API

💀 Wayback Machine Subdomains

💀 CommonCrawl Extraction

💀 Subdomains

💀 DNS Zone Transfer Attempt

💀 Reverse IP Lookup

💀 BGP/ASN Range Scanner

💀 PTR Records from IP Range

💀 All-in-One Mega Oneliner

💀 Subdomain Permutation/Bruteforce

💀 DNS Wordlist Bruteforce with PureDNS

💀 TLS/SSL Certificate Grabber

💀 Favicon Hash -> Shodan

💀 Google Dork Subdomain Discovery

---

🔐 TLS/SSL Reconnaissance (TLSX)

<di="center">

🔐 TLS/SSL Certificate Intelligence with TLSX 🔐

</div>

🔐 Basic TLS Certificate Scan

🔐 Subdomain Discovery via SANs

🔐 Expired Certificate Hunter

🔐 Self-Signed Certificate Detection

🔐 TLS Enumeration (Weak TLS)

🔐 JARM Fingerprinting Pipeline

🔐 Certificate Chain & Issuer Analysis

🔐 Mass TLS Scan with Cipher Enumeration

🔐 Mismatched Certificate Detection

🔐 Ultimate TLS Recon Pipeline

---

🌐 DNS Intelligence (DNSX)

<di="center">

🌐 DNS Reconnaissance & Intelligence Gathering with DNSX 🌐

</div>

🌐 1. Mass DNS Resolution + Wildcard Filtering

🌐 2. Multi-Record Type DNS Enumeration

🌐 3. CNAME Extraction for Subdomain Takeover

🌐 4. Reverse DNS (PTR) on IP Ranges

🌐 5. MX Records for Email Security Analysis

🌐 6. NS Records + DNS Zone Transfer Check

🌐 7. DNS Brute-force with Custom Resolvers

🌐 8. JSON Output for Ad Parsing

🌐 9. ASN Discovery via DNS + IP Correlation

🌐 10. Ultimate DNS Recon Pipeline

> 🎯 Pro Tip: Use custom resolvers for better performance: dnsx -r resolvers.txt -rl 1000

---

📜 Ja Recon

Complete JS Pipeline

Extract Secrets from JS

LinkFinder on JS Files

SecretFinder Mass Scan

JS Extraction

API Keys from JS

Extract All URLs from JS

Find API Endpoints in JS

Extract Hardcoded Credentials

Extract AWS Keys from JS

Extract Google API Keys from JS

Extract Firebase URLs from JS

Extract S3 Buckets from JS

Extract Internal IPs from JS

Extract Slack Webhooks from JS

Extract GitHub Tokens from JS

Extract Private Keys from JS

Extract Email Addresses from JS

Extract Hidden Subdomains from JS

💀 Extract GraphQL Endpoints from JS

💀 Extract JWT Tokens from JS Files

💀 Find Webpack Source Maps

💀 Extract Discord Webhooks from JS

💀 Find Hidden Admin Routes in JS

---

💉 XSS Detection

Dalfox Pipeline

Blind XSS with Callback

Airixss Fast Scan

Knoxss API

DOM XSS Detection

Mass XSS with Nuclei DAST

Reflected Parameter Detection

XSS Polyglot Testing

---

🗄️ SQL Injection

SQLMap Mass Scan

Error-Based Detection

Time-Based Blind

Ghauri Scan

UNION Detection

Boolean-Based Detection

NoSQL Injection

---

🌐 SSRF & SSTI

SSRF with Interactsh

SSRF Parameter Fuzzing

SSTI Detection

SSTI Payload Test

Full SSRF Chain

SSRF with DNS Rebinding

Jinja2 SSTI

---

🕷️ Web Crawling

Katana Deep Crawl

Gospider Full Crawl

Hakrawler with Scope

ParamSpider Discovery

Waymore Historical URLs

Crawl with Headless Browser

Extract Forms

💀 Katana Multi-Target Deep Crawl + JS Parsing

💀 Gospider Recursive + Sitemap + Robots

💀 Hakrawler + Wayback + GAU Combined Crawler

💀 Katana Headless + Form Autofill + Screenshot

💀 Cariddi Full Crawl with Secret Detection

💀 Parallel Domain Crawler Pipeline

💀 Katana + Gospider + LinkFinder Chain

💀 Recursi + Nuclei Auto-Scan Pipeline

💀 Waymore + Katana Historical + Li

💀 Multi-Crawler Output Dedup + Parameter Extraction

---

🔑 Parameter Discovery

X8 Hidden Parameters

Arjun Discovery

Custom Param Bruteforce

Mine Parameters from JS

Parameter Pollution Test

---

📁 Content Discovery

Ffuf Directory Bruteforce

💀 Recursi - ffuf Deep Scan

💀 Feroxbuster Full Recursive Scan

💀 Feroxbuster Multi-Target Recursive

💀 ffuf + Feroxbuster Pipeline (Extensions + Recursion)

💀 Recursi with Extensions Mass Scan

💀 Feroxbuster Parallel Recursive Scan

💀 Feroxbuster Silent Recursive + Headers

💀 Feroxbuster Extract Links + Recursive

💀 Feroxbuster Resume + Filter by Size

💀 Feroxbuster API Endpoints Discovery

Git Exposure

Sensiti

Backup Files

API Documentation

Source Code Leak

Config Files

Database Files

---

⚡ Nuclei Scanning

Full Template Scan

C

Subdomain Takeover

Exposed Panels

Misconfigurations

DAST Mode

Custom Tags

Network Scanning

---

🔌 API Security Testing

GraphQL Introspection

REST API Enumeration

JWT Analysis

API Key Leakage

Broken Authentication

Rate Limiting Test

BOLA/IDOR Testing

💀 API Endpoint Fuzzing with ffuf

💀 API Fuzzing

💀 REST API Methods Fuzzing

💀 GraphQL Fuzzing with ffuf

💀 API Parameter Fuzzing

💀 API Authentication Bypass Fuzzing

💀 OpenAPI/Swagger Fuzzing

💀 API JSON Fuzzing with Nuclei

💀 API Mass Assignment Fuzzing

💀 API FUZZ with Custom Wordlist Generation

---

☁️ Cloud Security

AWS S3 Bucket Finder

S3 Permission Check

Firebase Database

Azure Blob Storage

GCP Storage

AWS Metadata SSRF

Cloud Credential Files

---

🤖 Automation Scripts

Full Recon Pipeline

XSS Hunter Script

API Recon Script

---

⚙️ Bash Functions

Add to your .bashrc or .zshrc:

---

🆕 New Oneliners 2026

⚡🔥⚡ TelnetPwn - C (CVSS 9.8 - CRITICAL) ⚡🔥⚡

> 💀 GNU InetUtils Telnetd Authentication Bypass - Instant Root Shell! Under Acti! 💀

#### ⚡ 1. Shodan Mass Telnet Discovery

#### ⚡ 2. Nmap Telnet Service Detection +

#### ⚡ 3. Masscan Fast Telnet Sweep

#### ⚡ 4. GNU InetUtils Telnetd Fingerprint

#### ⚡ 5. C Check (Safe)

#### ⚡ 6. Nuclei C Scanner

#### ⚡ 7. Banner Grabbing + Extraction

#### ⚡ 8. Subnet Telnet Hunter

#### ⚡ 9. Telnet + OS Fingerprint Correlation

#### ⚡ 10. Full C Recon Pipeline

> ⚠️ Affected: GNU InetUtils telnetd 1.9.3 - 2.7 (Debian/Ubuntu/Kali/Trisquel)
> ✅ Fix: Update to GNU InetUtils 2.8+ or disable telnetd and use SSH

---

⚡🔥⚡ Ni8mare - C (CVSS 10.0 - CRITICAL) ⚡🔥⚡

> 💀 Critical Unauthenticated RCE in n8n Workflow Automation - 100,000+ servers affected! Added to CISA KEV 💀

#### ⚡ Detect n8n Instances (Shodan/Censys)

#### ⚡ Fingerprint n8n Installations

#### ⚡ Check Webhook Endpoints

#### ⚡ Content-Type Confusion Detection

#### ⚡ Mass n8n Detection

#### ⚡ Nuclei Template Check for C

> ⚠️ Affected: n8n < 1.121.0 | ✅ Fix: Update to n8n 1.121.0+

---

⚡🔥⚡ N8n Auth RCE - C (CVSS 10.0 - CRITICAL) ⚡🔥⚡

> 💀 Authenticated RCE via Git Node in n8n - Cloud & Self-hosted affected! 💀

#### ⚡ Detect Git Node Enabled Instances

#### ⚡ Check n8n Authentication Endpoints

> ⚠️ Affected: n8n < 1.121.3 | ✅ Fix: Update to n8n 1.121.3+

---

⚡🔥⚡ D-Link DSL RCE - C (CVSS 9.3 - CRITICAL) ⚡🔥⚡

> 💀 Command Injection in Legacy D-Link DSL Routers - Under acti! 💀

#### ⚡ Shodan Dork for D-Link DSL Routers

#### ⚡ Detect dnscfg.cgi Endpoint

#### ⚡ Mass D-Link Fingerprint

> ⚠️ Affected: Legacy D-Link DSL Gateway Routers (EOL) | ✅ Fix: Replace with supported devices

---

⚡🔥⚡ Veeam Backup RCE - C (CVSS 9.0 - CRITICAL) ⚡🔥⚡

> 💀 RCE Parameter Injection in Veeam Backup & Replication 💀

#### ⚡ Detect Veeam Backup Servers

#### ⚡ Fingerprint Veeam Instances

> ⚠️ Affected: Veeam B&R 13.0.1.180 and earlier | ✅ Fix: Update to 13.0.1.1071+

---

⚡🔥⚡ Grafana Ghost XSS - C (HIGH SE) ⚡🔥⚡

> 💀 Zero-Day XSS in Grafana - 46,500+ instances still ! Account Takeo 💀

#### ⚡ Find Grafana Instances

#### ⚡ Detect Grafana

#### ⚡ Check Open Redirect (C )

#### ⚡ Mass Grafana Login Page Detection

> ⚠️ Affected: Multiple Grafana | ✅ Fix: Update to latest patched

---

⚡🔥⚡ C Subdomain Hunting - Mass Detection Pipeline ⚡🔥⚡

> 💀 10 Oneliners to hunt C across subdomains at scale! 💀

#### ⚡ 1. Full Subdomain C Hunt Pipeline (n8n + Grafana + D-Link)

#### ⚡ 2. Mass n8n C Detection on Subdomains

#### ⚡ 3. C n8n Git Node RCE Subdomain Scanner

#### ⚡ 4. Grafana C XSS + Open Redirect Subdomain Hunt

#### ⚡ 5. Multi-C Scanner with Nuclei (Parallel Templates)

#### ⚡ 6. Subdomain n8n Webhook Fingerprint + C Check

#### ⚡ 7. C IoT/Router Hunt (D-Link DSL + Other Routers)

#### ⚡ 8. Veeam C Subdomain Detection

#### ⚡ 9. Combined C Fingerprint + Extractor

#### ⚡ 10. Full C Recon Automation Script

> 🎯 Pro Tip: Combine with notify to get real-time alerts: ... | notify -silent -provider slack

---

⚡🔥⚡ Ad Reconnaissance Pipeline - 2026 Edition ⚡🔥⚡

> 🎯 10 Elite Oneliners for comprehensi - Multi-源码 enumeration, ASN discovery, JS analysis & more! 🎯

#### ⚡ 1. Multi-源码 Subdomain Discovery + Tech Fingerprinting

> Combines Subfinder + Assetfinder + Amass for maximum subdomain co, then with httpx + technology fingerprinting

#### ⚡ 2. ASN Enumeration + Reverse DNS Discovery

> Discovers ASN, enumerates IP blocks, performs reverse DNS to find hidden subdomains

#### ⚡ 3. URL Discovery Pipeline (Wayback + GAU + Katana)

> Parallel URL collection from Wayback Machine, Common Crawl, AlienVault + acti with smart deduplication

#### ⚡ 4. Ja Deep Analysis + Secret Scanner

> Finds JS files, extracts hardcoded secrets (API keys, tokens, AWS keys) and hidden API endpoints

#### ⚡ 5. Certificate Transparency + Subdomain Permutation Attack

> CT logs enumeration + intelligent permutation (api → api-de) with mass DNS resolution

#### ⚡ 6. Port Discovery + Web Services on Non-Standard Ports

> Fast port scan + discovers web apps running on unusual ports (8080, 8443, 3000, etc)

#### ⚡ 7. GitHub Dorking Automation for Target Organization

> Automated GitHub dorking for secrets, credentials and sensitive data exposure

#### ⚡ 8. Cloud Storage Discovery (S3 + Azure + GCP)

> Extracts and misconfigured cloud storage buckets from collected URLs

#### ⚡ 9. Parameter Discovery + Pattern Matching

> Extracts unique parameters and categorizes by type (XSS, SSRF, SQLi, Redirect)

#### ⚡ 10. Continuous Recon Monitor (Cron-Ready)

> Full persistent recon pipeline - detects new assets daily and sends notifications

> 🎯 Pro Tip: Run oneliner #10 via cron for 24/7 monitoring: 0 */6 * * * /path/to/recon_monitor.sh

---

⚡🔥⚡ Ja Endpoint Extraction - Elite Techniques 2026 ⚡🔥⚡

> 🎯 10 Oneliners to extract endpoints, secrets and hidden APIs from Ja files! 🎯

#### ⚡ 1. Mass JS File Discovery + Download Pipeline

> Discovers all JS files with Katana, filters by size (>500 bytes), downloads for offline analysis

#### ⚡ 2. Extract All API Endpoints from JS Files

> Extracts all relative API paths from Ja, filters static assets

#### ⚡ 3. AWS Keys Hunter in JS Files

> Hunts for AWS Access Key IDs (AKIA, ABIA, ACCA, ASIA patterns)

#### ⚡ 4. Google API Keys + Firebase URLs Extractor

> Extracts Google API keys and Firebase 数据库/app URLs

#### ⚡ 5. S3 Bucket Discovery in Ja

> Finds S3 buckets in JS and accessibility

#### ⚡ 6. Internal IP Addresses Leakage

> Discovers internal/private IP addresses leaked in Ja (10.x, 172.16-31.x, 192.168.x)

#### ⚡ 7. Slack Webhooks + Discord Tokens in JS

> Extracts Slack webhook URLs and Discord bot tokens

#### ⚡ 8. GitHub Tokens + Private Keys Detection

> Finds GitHub personal access tokens (all formats) and private key headers

#### ⚡ 9. Email Addresses + Hidden Subdomains in JS

> Extracts email addresses and hidden subdomains referenced in Ja

#### ⚡ 10. Full JS Recon Pipeline (All-in-One)

> Complete JS recon pipeline: discovers JS files, downloads all, extracts AWS/Google/GitHub keys and API endpoints

> 🎯 Pro Tip: Use nuclei -t exposures/tokens/ on discovered secrets to if they're active!

---

🆕 Oneliners 2024-2025

⚡🔥⚡ React2Shell - C (CVSS 10.0 - CRITICAL) ⚡🔥⚡

> 💀 Critical RCE in React Ser & Next.js - Under acti! Added to CISA KEV 💀

#### ⚡ Detect Next.js Apps (Recon First)

#### ⚡ Check if Next-Action Header is Accepted

#### ⚡ Mass Detection - Next-Action Header Accepted

#### ⚡ Create Payload Files for Testing

#### ⚡ Manual Check with cURL

#### ⚡ One-liner: Full Detection Pipeline

#### ⚡ Detect Response Headers

#### ⚡ Mass Scan with httpx + Next-Action Probe

#### ⚡ Shodan Dork for Next.js Targets

#### ⚡ Nuclei Template Check

#### ⚡ Find & Test - Complete One-liner

#### ⚡ Check RSC Endpoint Directly

#### ⚡ Batch Test from File with Parallel

> ⚠️ Affected: React 19.0.0-19.2.0, Next.js 15.0.4-16.0.6 | ✅ Fix: Update to React 19.0.1/19.1.2/19.2.1
>
> 🎯 Key Detection: Apps accepting Next-Action header + RSC deserialization = Potential RCE

---

🆕 February 2026 C Oneliners

> 🔍 Recon-focused oneliners to detect critical from February 2026
>
> ⚠️ Note: Some oneliners reference nuclei-templates paths that may not exist yet in your local copy. Run nuclei -update-templates first and the template exists (ls ~/nuclei-templates/...) before running. Always confirm C against the official ad and stay within your authorized scope.

⚡ Cisco Catalyst SD-WAN - C Discovery

> Critical (CVSS 10.0) that allows authentication bypass in Cisco SD-WAN Manager/Controller. Exploited since 2023 by ad threat actors. Detecting instances is crucial to protect critical infrastructure.

#### 1. Disco Cisco SD-WAN Manager/

---

⚡ Microsoft Azure Functions - C Discovery

> Information disclosure (CVSS 8.2) in Azure Functions that allows exposure of credentials and sensiti without authentication. Identifying endpoints is essential to prevent secret leakage.

#### 1. Enumerate Azure Function endpoints with nuclei

---

⚡ Gradio Framework - C Path Tra Discovery

> Critical path tra (CVSS 7.5) in Gradio <6.7 running on Windows with Python 3.13+. Allows arbitrary file read. Detecting is vital to protect ML/AI apps.

#### 1. Identify Gradio applications and detect

---

⚡ Gradio Framework - C SSRF Discovery

> High-se SSRF (CVSS 8.2) in Gradio <6.6.0 that allows access to cloud metadata services (AWS/GCP/Azure). Crucial to prevent compromise of cloud credentials.

#### 1. Disco instances Dorks and fingerprinting

---

⚡ Fortinet FortiOS - C LDAP Credentials Discovery

> LDAP credentials disclosure in FortiOS ≤7.6.6 due to a weak default encryption key. Actively exploited since December 2025. Detecting is critical.

#### 1. Identify FortiGate/FortiOS with

---

⚡ Dell Reco for VMs - C Discovery

> Critical hardcoded credentials (CVSS 10.0) in Dell Reco <6.0.3.1 HF1. Allows remote root access. Exploited by Chinese APT groups since 2024. Urgent detection required.

#### 1. Detect exposed Dell Reco and identify Tomcat Manager

---

⚡ Windows Shell - C Security Bypass Discovery

> SmartScreen/Mark-of-the-Web bypass (CVSS 8.8) in Windows 10/11. Allows 代码 execution links/shortcuts. Actively exploited zero-day. Fingerprinting systems is essential.

#### 1. Identify exposed Windows endpoints and via SMB

---

⚡ Statamic CMS - C XSS Discovery

> Critical stored XSS (CVSS 8.7) in Statamic <5.73.11 and <6.4.0 via SVG/PDF and Antlers templates. Allows pri escalation. Detecting protects Control Panels.

#### 1. Disco sites and extract CMS

---

⚡ Chartbrew - C SQL Injection Discovery

> Critical unauthenticated SQL Injection (CVSS 9.8) in Chartbrew <4.8.3. Allows read/modification of data in connected MySQL/PostgreSQL. Detecting instances is urgent.

#### 1. Identify exposed Chartbrew instances and check via API

---

⚡ Chartbrew - C MongoDB RCE Discovery

> RCE query injection (CVSS 7.2) in Chartbrew <4.8.1. Allows arbitrary Ja execution on the MongoDB 服务端. Crucial to detect instances before exploitation.

#### 1. Enumerate Chartbrew endpoints while scanning for APIs

---

⚡ Apache Camel - C Header Injection Discovery

> Critical header injection (CVSS 9.1) in Apache Camel <4.9.2 that allows filter bypass via HTTP header manipulation (CamelExec*). Detecting exposed Camel endpoints protects enterprise integration pipelines.

#### 1. Disco Camel endpoints and test header injection bypass

---

⚡ Jenkins CI - C Script Console RCE Discovery

> RCE Console (CVSS 9.8) in Jenkins <2.503 with weak or anonymous auth enabled. Allows arbitrary Groo. Fingerprinting exposed instances is urgent to protect CI/CD.

#### 1. Identify exposed Jenkins and check for an accessible Script Console

---

⚡ GraphQL Introspection - C Schema Leak Discovery

> Information disclosure (CVSS 7.5) left enabled in production. Allows full mapping of the schema, mutations and sensiti. Detecting endpoints with open introspection accelerates attack-surface mapping.

#### 1. Disco endpoints and detect enabled introspection

---

⚡ Ollama AI - C Model Path Tra Discovery

> Path tra (CVSS 8.6) in Ollama <0.5.9 via the /api/pull API that allows arbitrary file write through malicious model names. Detecting exposed Ollama instances protects local AI infrastructure.

#### 1. Identify exposed Ollama servers and enumerate loaded models

---

⚡ Spring Boot Actuator - C En Exposure Discovery

> Secret exposure (CVSS 8.2) via an unprotected /actuator/env endpoint in Spring Boot. Leaks 数据库 credentials, tokens and API keys. Mass detection of open actuators is fundamental to prevent leaks.

#### 1. Disco Spring Actuator endpoints and extract sensiti

---

Nuclei DAST XSS

Open Redirect Mass

CORS Misconfiguration

Host Header Injection

CRLF Injection

Prototype Pollution

Cache Poisoning Detection

IDOR Pattern Detection

Race Condition URLs

WebSocket Endpoints

Path Tra

XXE Detection

Log4j Scan

Blind Command Injection

Mass Screenshot

Technology Detection

Favicon Hash (Shodan)

Exposed Admin Panels

Debug Endpoints

Spring Boot Actuators

WordPress Enumeration

Lara Mode

Django Debug

HTTP Request Smuggling

CSP Bypass Check

Subdomain from Favicon

---

🔍 Search Engines for Hackers

| Engine | Link | Description |
|:------:|:----:|:-----------:|
| Shodan | shodan.io | IoT & device search |
| Censys | censys.io | Internet scan data |
| Fofa | fofa.info | Cyberspace search |
| ZoomEye | zoomeye.org | Cyberspace mapping |
| Hunter | hunter.how | Asset discovery |
| Netlas | netlas.io | Attack surface |
| GreyNoise | greynoise.io | Internet scanners |
| Onyphe | onyphe.io | Cyber defense |
| CriminalIP | criminalip.io | Threat intel |
| FullHunt | fullhunt.io | Attack surface |
| Quake | quake.360.net | Cyberspace search |
| Leakix | leakix.net | Leak detection |
| URLScan | urlscan.io | URL analysis |
| DNSDumpster | dnsdumpster.com | DNS recon |
| crt.sh | crt.sh | Certificate search |
| SecurityTrails | securitytrails.com | DNS history |
| Pulsedive | pulsedive.com | Threat intel |
| | .com | File/URL analysis |
| PublicWWW | publicwww.com | Source code search |
| Grep.app | grep.app | GitHub code search |

---

📖 Recommended Wordlists

| Wordlist | Link | Use Case |
|:---------|:----:|:---------|
| SecLists | GitHub | E |
| FuzzDB | GitHub | Fuzzing |
| Assetnote | wordlists.assetnote.io | Web content |
| OneListForAll | GitHub | Combined |
| jhaddix all.txt | GitHub | Directories |
| commonspeak2 | GitHub | Real-world |

---

📚 Learning Resources

Books

Platforms

Practice

Blogs & Resources

---

🙏 Special Thanks

<di="center">

| Hunter | Hunter | Hunter |
|:------:|:------:|:------:|
| | | |
| | | |
| | | |
| | | @0xacb |

</div>

---

🤝 Contributing

<di="center">

We welcome contributions from the community! Your expertise makes this repository better.

![Contributors]()
![Pull Requests]()
![Issues]()

</div>

💡 How to Contribute

<details>
<summary><b>📝 Click to see contribution guidelines</b></summary>

<br>

1. Fork the Repository

2. Create a New Branch

3. Add Your Content
- Add new one-liners with proper documentation
- Include 源码 references and explanations
- Follow the existing format and structure

4. Submit Pull Request
- Write a clear description of your changes
- Reference any related issues
- Wait for review and feedback

✨ What to Contribute

</details>

---

📊 Repository Analytics

<di="center">

<table>
<tr>
<td align="center">
<img src=" alt="Stars"><br>
<b>Stars</b>
</td>
<td align="center">
<img src=" alt="Forks"><br>
<b>Forks</b>
</td>
<td align="center">
<img src=" alt="Watchers"><br>
<b>Watchers</b>
</td>
<td align="center">
<img src=" alt="Contributors"><br>
<b>Contributors</b>
</td>
</tr>
</table>

📈 Growth Chart

![Star History Chart]()

</div>

---

💖 Support the Project

<di="center">

If this repository helped you in your bug bounty journey, consider supporting the project!

<a href=" target="_blank">
<img src=" alt="Buy Me A Coffee" width="200">
</a>

⭐ Show Your Support

Give this repository a star if you found it helpful!

![GitHub stars]()

</div>

---

📜 License & Legal

<di="center">


<p>
<img src="
<img src="
<img src="
<img src="
</p>

</div>

⚠️ Important Disclaimer

<di="center">

</div>

---

🔗 Quick Links & Resources

<di="center">

| Resource | Link |
|:---------|:-----|
| 🏠 Homepage | King of Bug Bounty Tips |
| 🛠️ KingRecon DOD | Automated Recon Tool |
| 🐧 BugBuntu OS | Download Here |
| 📺 YouTube Channel | OFJAAAH |
| 💬 | Join Community |
| 🐦 Twitter/X | |
| 💼 LinkedIn | Connect |
| 🐛 Report Issues | GitHub Issues |
| 🔐 Security Issues | Security Ad |

</div>

---

<di="center">

🌟 Special Thanks

To all contributors, bug bounty hunters, and the security community who make this project possible!

---

Last Updated: July 2026 | : 4.6

<img src="
<img src="
<img src="

<br><br>

<br>

Made with ❤️ by the Bug Bounty Community

</div>

项目信息

开发语言：Python

Star 数：5541

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters..展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。