⚙️ Complete Bug Bounty tool List ⚙️

Enjoy :)

dnscan https://github.com/rbsec/dnscan

Knockpy https://github.com/guelfoweb/knock

Sublist3r https://github.com/aboul3la/Sublist3r

massdns https://github.com/blechschmidt/massdns

Nmap https://nmap.org

Masscan https://github.com/robertdavidgraham/masscan

EyeWitness https://github.com/ChrisTruncer/EyeWitness

DirBuster https://sourceforge.net/projects/dirbuster/

dirsearch https://github.com/maurosoria/dirsearch

Gitrob https://github.com/michenriksen/gitrob

git-secrets https://github.com/awslabs/git-secrets

sandcastle https://github.com/yasinS/sandcastle

bucket_finder https://digi.ninja/projects/bucket_finder.php

GoogD0rker https://github.com/ZephrFish/GoogD0rker/

Wayback Machine https://web.archive.org

waybackurls https://gist.github.com/mhmdiaa/adf6bff70142e5091792841d4b372050

Sn1per https://github.com/1N3/Sn1per/

XRay https://github.com/evilsocket/xray

wfuzz https://github.com/xmendez/wfuzz/

patator https://github.com/lanjelot/patator

datasploit https://github.com/DataSploit/datasploit

hydra https://github.com/vanhauser-thc/thc-hydra

changeme https://github.com/ztgrace/changeme

MobSF https://github.com/MobSF/Mobile-Security-Framework-MobSF/

Apktool https://github.com/iBotPeaches/Apktool

dex2jar https://sourceforge.net/projects/dex2jar/

sqlmap http://sqlmap.org/

oxml_xxe https://github.com/BuffaloWill/oxml_xxe/

XXE Injector https://github.com/enjoiz/XXEinjector

The JSON Web Token Toolkit https://github.com/ticarpi/jwt_tool

ground-control https://github.com/jobertabma/ground-control

ssrfDetector https://github.com/JacobReynolds/ssrfDetector

LFISuit https://github.com/D35m0nd142/LFISuite

GitTools https://github.com/internetwache/GitTools

dvcs-ripper https://github.com/kost/dvcs-ripper

tko-subs https://github.com/anshumanbh/tko-subs

HostileSubBruteforcer https://github.com/nahamsec/HostileSubBruteforcer

Race the Web https://github.com/insp3ctre/race-the-web

ysoserial https://github.com/GoSecure/ysoserial

PHPGGC https://github.com/ambionics/phpggc

CORStest https://github.com/RUB-NDS/CORStest

Retire-js https://github.com/RetireJS/retire.js

getsploit https://github.com/vulnersCom/getsploit

Findsploit https://github.com/1N3/Findsploit

bfac https://github.com/mazen160/bfac

WPScan https://wpscan.org/

CMSMap https://github.com/Dionach/CMSmap

Amass https://github.com/OWASP/Amass

Extra Tools
http://projectdiscovery.io

❤ Share & Support & Reaction Us
🧩 #tools #BugBounty
📰 @BackupLSO
📚 @LibrarySecOfficial

SQLi -- Learn SQL All in One Method - Best SQL Injection Methods

❤ Share & Support & Reaction Us
🧩 #Sqli #injection
📰 @BackupLSO
📚 @LibrarySecOfficial

Golden checklist for every beginner out there 👇 by Godfather Orwa

1 spend 1-2 hours understanding burp & burp extensions

2 spend 1-2 day understanding subdomain enumeration with more than 1 tool

3 don’t forget scanning port all the time
4 use waymore tool to extract endpoint from lot of resources

5 keep ai chat is opening and ask anything anytime

6 autorized & JS miner is so important extensions read about it and use it


❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 An easy way to read bug bounty witeups

If you are tired of googling for #BugBounty writeups, You can use this tool which lets you search writeups easily. You can also pull the search data in JSON format if you need it.

Just like a Google query you can append the search term to the 'q' parameter to search for writeups matching that keyword. And I don't save your searches, everything happens on the frontend.

🔴Example: bugbountyhunting.com/?q=csrf (for example, to search for CSRF writeups)

🖥 Tool: 🔗 Link

❤ Share & Support & Reaction Us
🧩 #bugbounty
📰 @BackupLSO
📚 @LibrarySecOfficial

Bug Bounty Guide

Bug Bounty is based on finding vulnerabilities in certain software.‍To claim the bounty, bugs must be original and previously unreported

Bug Bounty Platforms

💠 HackerOne
https://www.hackerone.com
💠 Bugcrowd
https://www.bugcrowd.com
💠 Synack
https://www.synack.com
💠 Detectify
https://cs.detectify.com
💠 Cobalt
https://cobalt.io
💠 Open Bug Bounty
https://www.openbugbounty.org
💠 Zero Copter
https://www.zerocopter.com
💠 Yes We Hack
https://www.yeswehack.com
💠 Hacken Proof
https://hackenproof.com
💠 Vulnerability Lab
https://www.vulnerability-lab.com
💠 Fire Bounty
https://firebounty.com
💠 Bug Bounty
https://bugbounty.jp/
💠 Anti Hack
https://antihack.me
💠 Intigrity
https://intigrity.com/
💠 Safe Hats
https://safehats.com
💠 Red Storm
https://www.redstorm.io/
💠 Cyber Army
https://www.cyberarmy.id
💠 Yogosha
https://yogosha.com

❤ Share & Support & Reaction Us
🧩 #bugbounty
📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 A TO Z ABOUT XSS

Overview:-
Cross-Site Scripting (XSS) attack are a type of injection,in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.

🧩 #XSS
📰 @BackupLSO
📚 @LibrarySecOfficial

Websites pentesting With Burpsuite

❤ Share & Support & Reaction Us
🧩 #Burpsuite
📰 @BackupLSO
📚 @LibrarySecOfficial

how to setup Mobile app Traffic proxy with Burp Suite

❤ Share & Support & Reaction Us
🧩 #Burpsuite
📰 @BackupLSO
📚 @LibrarySecOfficial

Scan for Vulnerabilities on Any Website Using Nikto

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

How Pentester Scan vulnerability of Any Website

❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

APIs Fuzzing for Bug Bounty


❤ Share & Support & Reaction Us

📰 @BackupLSO
📚 @LibrarySecOfficial

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

📖 Cyber ​​Security books and sources
📚 @LibrarySecOfficial

💠 Blueteam sources:
⭕️ @BlueTeamKit

💠 Osint tools and courses:

⭕️ @OsintGit

💠 Cyber ​​Security Courses and Resources & Learn Bug bounty:

⭕ @BackupLso


💠 All Red Team resources are here!

⭕ @RedTeamVillageRtv


💠 To add to the message list:
🤖 @LibrarySecOfficialBot

⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️⚜️

🔖 Subdomain Hunting Netflix Enumeration

❤ Share & Support US
#SubDomain
📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 403 Bypass Payloads

❤ Share & Support US
🧩 #Bypass
📰 @BackupLSO
📚 @LibrarySecOfficial

RCE VULNERABILITY CHECKLIST

📰 @BackupLSO
📚 @LibrarySecOfficial

✎ Deobfuscate obfuscator.io, unminify, transpile, and unpack webpack/browserify, using webcrack to resemble the original source code as much as possible.

Command Line Interface

npm install -g webcrack

Examples

webcrack input.js
webcrack input.js > output.js
webcrack bundle.js -o output-dir

• Repository: Github
• Website: webcrack.netlify.app

#bugbounty #recon #javascript #deobfuscate
📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 XML External Entity XXE Attack
🧩 #XXE #XML
📰 @BackupLSO
📚 @LibrarySecOfficial

🔖 Session Fixation, Session Hijacking, and Captcha Bypass

📰 @BackupLSO
📚 @LibrarySecOfficial

🧑‍🎓 👉 SQL Injection $1000 Bounty | Bug bounty POC by The Cyberboy, 2024

See also:
❗️ How Finding an SQL Injection Vulnerability Earned a $1000 Bug Bounty
❗️ SQL Injection Bug Bounty POC
❗️ SQL Injection by HackTricks

📰 @BackupLSO
📚 @LibrarySecOfficial

Happy new year 2026

OWASP Juice Shop Walkthrough All-in-one-PDF, 2025 (upd)

Updated 2025 version

OWASP Juice Shop is probably the most modern and sophisticated insecure web application! It can be used in security trainings, awareness demos, CTFs and as a guinea pig for security tools!

Juice Shop encompasses vulnerabilities from the entire OWASP Top Ten along with many other security flaws found in real-world applications!

💥Official page

Early post:
YouTube playlist + PDF (2020)

❤ Share & Support & Reaction Us
🧩 #Owasp
📰 @BackupLSO
📚 @LibrarySecOfficial