Web_Hacking - Bug Bounty Tricks and useful payloads and bypasses

项目说明

Web Hacking + Bug Bounty Tricks

!5829442

These are my Bug Bounty / Pentest notes that I ha from sources.

You can also contribute.

![Twitter URL]()

Golden Tips

* Writeups
* Smart Hunting

Recon & OSINT Techniques

* Recon
* OSINT

List of

* API Key Leak
* CORS
* CRLF Injection
* CSRF
* Cache Poisoning / Deception
* Command Injection
* DOM Clobbering
* File Inclusion
* File Upload
* GraphQL
* Host Header Injection
* IDOR
* JWT
* NoSQLi
* Open Redirect
* Race Condition
* Reverse Tab Nabbing
* SQLi
* SSRF
* Sandwich Attack
* XSS
* XXE

Bypass Techniques

* General E Techniques
* 2FA / OTP Bypass
* 403 Bypass
* 429 Bypass
* Captcha Bypass
* CSP Bypass
* Email Bypass
* Login Bypass
* Rate Limit Bypass
* Reset Password Bypass
* WAF Detect / Bypass

Cloud / Docker

* General
* Info Gathering
* AWS
* Azure
* GCP
* CDN - Domain Fronting
* Docker & Kubernetes
* Container Attacks

Top Tools & Extensions

* Nuclei - Nuclei is a modern, high-performance scanner that le simple YAML-based templates
* inql - Burp extension for ad GraphQL testing
* Logger++ - Burp extension, a multithreaded logging extension for Burp Suit
* param-miner - Burp extension, identifies hidden, unlinked parameters
* Oralyzer - a simple python script that probes for Open Redirection in a website
* Darkmoon - Open source (GPL-3.0) autonomous AI penetration testing platform co web, API, Acti and Kubernetes, orchestrating 80+ offensi as an MCP host with proof of exploitation and a local privacy gateway (the LLM never sees real IPs or credentials).
* SQLiPy Sqlmap Integration - SQLiPy is a Python plugin for Burp Suite that integrates SQLMap using the SQLMap API
* ParamSpider - Parameter miner for humans
* gf - A wrapper around grep to avoid typing common patterns

Mindmaps for Bug Hunters

* XXE
* SSRF
* CORS
* Prototype Pollution

Red Team Attacks

* Insecure Interfaces and APIs - For Cloud
* Pri escalation EC2
* SMTP

Secure Coding

* 2FA
* Password Reset
* Session Fixation
* Broken Object Le
* Broken Authentication
* Broken Object Property Le
* Unrestricted Resource Consumption
* Broken Function Le
* Unrestricted Access to Sensiti Flows
* Server Side Request Forgery
* Security Misconfiguration
* Improper In Management
* Unsafe Consumption of APIs

-----
*All content of this repository will always be updated...*

项目信息

开发语言：未知

Star 数：817

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Bug Bounty Tricks and useful payloads and bypasses for Web Application Security.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。