mirror of
https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters.git
synced 2025-02-16 12:28:29 +00:00
August Update
This commit is contained in:
Peer Heinen
parent
7b297840a3
commit
9df0c96697
9 changed files with 89 additions and 4 deletions
|
|
@ -6,7 +6,7 @@ There are a number of new hackers joining the community on a regular basis and m
|
|||
|
||||
We understand that there are more resources other than the ones we have listed and we hope to cover more resources in the near future!<br>
|
||||
|
||||
## Current Version: 2020.06
|
||||
## Current Version: 2020.08
|
||||
|
||||
[Changelog: See what's new!](/assets/changelog.md) 📣
|
||||
|
||||
|
|
|
|||
|
|
@ -78,6 +78,7 @@ You can find a ton of awesome XSS reports by searching through the HackerOne Hac
|
|||
- [How I was able to bypass OTP code requirement in Razer [The story of a critical bug]](https://medium.com/bugbountywriteup/how-i-was-able-to-bypass-otp-token-requirement-in-razer-the-story-of-a-critical-bug-fc63a94ad572?) - Ananda Dhakal
|
||||
- [Bypassing GitHub's OAuth flow](https://blog.teddykatz.com/2019/11/05/github-oauth-bypass.html) - [@not_aardvark](https://twitter.com/not_aardvark)
|
||||
- [Subdomain Takeover to Authentication bypass](https://hackerone.com/reports/335330) - by geekboy
|
||||
- [Ability to know the presence of a person in a private event even if the guest list is hidden.](https://bugreader.com/index.php?pageNav=vivekps143%40193) - by [Vivek PS](https://bugreader.com/vivekps143)
|
||||
|
||||
|
||||
## SQL Injection
|
||||
|
|
@ -121,6 +122,7 @@ You can find a ton of awesome XSS reports by searching through the HackerOne Hac
|
|||
- [GraphQL IDOR leads to information disclosure](https://medium.com/@R0X4R/graphql-idor-leads-to-information-disclosure-175eb560170d) - [@R0X4R](https://twitter.com/R0X4R)
|
||||
- [From Multiple IDORs leading to Code Execution on a different Host Container](https://www.rahulr.in/2019/10/idor-to-rce.html?m=1) - [@Rahul_R95](https://twitter.com/Rahul_R95)
|
||||
- [Automating BURP to find IDORs](https://medium.com/cyberverse/automating-burp-to-find-idors-2b3dbe9fa0b8) - [Aditya Soni](https://medium.com/@hetroublemakr)
|
||||
- [Another image removal vulnerability on Facebook](https://blog.darabi.me/2020/06/image-removal-vulnerability-on-facebook.html) - by Pouya
|
||||
|
||||
## GraphQL
|
||||
- [Private System Note Disclosure using GraphQL](https://hackerone.com/reports/633001) - Ron Chan
|
||||
|
|
|
|||
|
|
@ -11,6 +11,7 @@ Due to the fact that a lot more Hunters are trying to get better in different fi
|
|||
- [ALL NEW OSCP - REVAMPED 2020](https://www.youtube.com/watch?v=wjTt-5mfyhY)
|
||||
- [OSCP Preparation](https://github.com/superhero1/OSCP-Prep) by sup3rhero1
|
||||
- [TJnull’s Preparation Guide for PWK/OSCP](https://www.netsecfocus.com/oscp/2019/03/29/The_Journey_to_Try_Harder-_TJNulls_Preparation_Guide_for_PWK_OSCP.html)
|
||||
- [hax](https://github.com/unmeg/hax) by unmeg (Useful scripts for OSCP boxes and other Certs)
|
||||
|
||||
---
|
||||
back to [Intro Page](/README.md)
|
||||
|
|
@ -4,6 +4,46 @@
|
|||
|
||||
Updates to this repo will be pushed monthly. You can read about the latest changes below.
|
||||
|
||||
---
|
||||
## ___Update 2020.08___
|
||||
### Added
|
||||
- [Tools](/assets/tools.md):
|
||||
- **threader3000** in the Scanner section<br>
|
||||
- **subfinder** in the Recon, OSINT & Discovery Section<br>
|
||||
- **SUBway** in the Recon, OSINT & Discovery Section<br>
|
||||
- **PenTest.ws** in the Notetaking Section<br>
|
||||
- [Blogposts & Disclosed Reports](/assets/blogposts.md):
|
||||
- **Ability to know the presence of a person in a private event even if the guest list is hidden.** - by Vivek PS<br>
|
||||
- **Another image removal vulnerability on Facebook** - by Pouya<br>
|
||||
- [Cheat Sheets](/assets/cheat.md):
|
||||
- **CloudPentestCheatsheets**
|
||||
- **HackTricks**
|
||||
- **Everything curl**
|
||||
- **GTFObins**
|
||||
- **Finding ENdpoints in JS Files**
|
||||
- **The Bug Hunter's Methodology v.4.01**
|
||||
- [Certifications](/assets/certs.md):
|
||||
- **hax**
|
||||
- [Setup](/assets/setup.md):
|
||||
- **Technical Project Ideas Towards Learning Cyber Security**
|
||||
- **Getting Starting With Tmux Isn't That Scary**
|
||||
- [Media](/assets/media.md):
|
||||
- **The Linux Command Line**
|
||||
- **The Mayor** in the Streamer Section
|
||||
- Added **Nahamsec,Hacker101,TryHackMe,HTB,TCM,AshF0x,TheMayor,Sup3rhero1 6 Ceos3c** to Discord Servers
|
||||
- Added **@PhillipWylie** on the Twitter-list
|
||||
- [Health](/assets/health.md):
|
||||
- **BSidesSF 2020 - Panel: Mental Health for Hackers (Chloé M • Ryan L • Susan P)**
|
||||
### Changes
|
||||
- Added a new section called [Cheat Sheets, Slides & More](/assets/cheat.md)
|
||||
- Added a new subcategory in [Setup](/assets/setup.md) for Tools
|
||||
- Added a sub category called [One Liners](/assets/cheat.md#One-Liners)
|
||||
- Added a sub category called [Slides](/assets/cheat.md#Slides)
|
||||
- Renamed "Media" to ["Media & Communities"](/assets/media.md)
|
||||
- Added a new section called [Discord Servers](/assets/media.md#Discord-Servers) in "Media & Communities"
|
||||
### Fixes
|
||||
- fixed Notion Link
|
||||
|
||||
---
|
||||
## ___Update 2020.06___
|
||||
### Added
|
||||
|
|
|
|||
19
assets/cheat.md
Normal file
19
assets/cheat.md
Normal file
|
|
@ -0,0 +1,19 @@
|
|||
# Resources-for-Beginner-Bug-Bounty-Hunters
|
||||
|
||||
## Cheat Sheets, Slides & More 🧪
|
||||
|
||||
### Cheat Sheets
|
||||
- [CloudPentestCheatsheets](https://github.com/dafthack/CloudPentestCheatsheets) by dafthack
|
||||
- [HackTricks](https://book.hacktricks.xyz/) by Carlos Polop
|
||||
- [Everything curl](https://ec.haxx.se/) by badger
|
||||
- [GTFObins](https://gtfobins.github.io/)
|
||||
|
||||
### One Liners
|
||||
- [Finding ENdpoints in JS Files](https://twitter.com/renniepak/status/1287804976669040642)
|
||||
|
||||
### Slides
|
||||
|
||||
- [The Bug Hunter's Methodology v.4.01](https://t.co/kfNNz0It7n?amp=1) - by Jason Haddix
|
||||
|
||||
---
|
||||
back to [Intro Page](/README.md)
|
||||
|
|
@ -8,7 +8,7 @@ Bug Bounties is a task that can be very challenging and competitive and it can a
|
|||
Getting in the right Mindset:
|
||||
- [Mental Hacking 4 Better Bounties:](https://youtu.be/roVg_wgGgxQ) by STÖK
|
||||
- [Happy Hacking:](http://phrack.com/issues/68/7.html#article) Phrack Volume 0x0e, Issue 0x44, Phile #0x07 of 0x13
|
||||
|
||||
- [BSidesSF 2020 - Panel: Mental Health for Hackers (Chloé M • Ryan L • Susan P)](https://youtu.be/raH7tRy8M7g)
|
||||
|
||||
---
|
||||
back to [Intro Page](/README.md)
|
||||
|
|
@ -1,6 +1,6 @@
|
|||
# Resources-for-Beginner-Bug-Bounty-Hunters
|
||||
|
||||
## Media Resources 🎬
|
||||
## Media Resources & Communities 🎬
|
||||
Here you find listings to useful media creations that can help beginners in different ways.
|
||||
|
||||
- [YouTube Channels](#Youtube-Channels)
|
||||
|
|
@ -8,7 +8,9 @@ Here you find listings to useful media creations that can help beginners in diff
|
|||
- [Podcasts](#Podcasts)
|
||||
- [Books](#Books)
|
||||
- [Twitter](#Twitter)
|
||||
- [Discord Servers](#Discord-Servers)
|
||||
- [Misc](#Misc)
|
||||
|
||||
---
|
||||
|
||||
## Youtube Channels
|
||||
|
|
@ -32,6 +34,7 @@ Here you find listings to useful media creations that can help beginners in diff
|
|||
- [Jason Haddix](https://www.twitch.tv/js0n_x/) on Twitch
|
||||
- [sup3rhero1](https://www.twitch.tv/sup3rhero1) on Twitch
|
||||
- [STÖK](https://www.twitch.tv/stokfredrik) on Twitch
|
||||
- [The Mayor](https://www.twitch.tv/themayor11) on Twitch
|
||||
|
||||
|
||||
## Podcasts
|
||||
|
|
@ -52,6 +55,7 @@ Michal Zalewski
|
|||
- [Web Hacking 101: How to Make Money Hacking Ethically](https://leanpub.com/web-hacking-101) by [Peter Yaworski](https://twitter.com/yaworsk)
|
||||
- [Black Hat Go](https://nostarch.com/blackhatgo) by Tom Steele, Chris Patten, and Dan Kottmann
|
||||
- [Black Hat Python](https://nostarch.com/blackhatpython) by Justin Seitz
|
||||
- [The Linux Command Line](https://nostarch.com/tlcl2) by William Shotts
|
||||
|
||||
In general ["no starch press"](https://nostarch.com/catalog/security) offers great books in the hacking category. [Humble Bundle](https://www.humblebundle.com) sometimes offfers great book deals for an awesome price, so have a eye out for those.
|
||||
|
||||
|
|
@ -128,8 +132,20 @@ The following list does not exclusively contains Bug Bounty themed Accounts but
|
|||
| [@ZephrFish](https://twitter.com/ZephrFish) | BB,Researcher |
|
||||
| [@CalumBoal](https://twitter.com/CalumBoal) | Pentester, Software dev, Coder |
|
||||
| [@_superhero1](https://twitter.com/_superhero1) | Streamer, Content Creator, BB |
|
||||
| [@PhillipWylie](https://twitter.com/PhillipWylie) | BB, Researcher, Pentester |
|
||||
|
||||
|
||||
## Discord Servers
|
||||
- [Nahamsec](https://discord.gg/d6dENAq)
|
||||
- [Hacker101](https://discord.gg/WrCTm8h)
|
||||
- [TryHackMe](https://discord.gg/KsAEejZ)
|
||||
- [HackTheBox](https://discord.gg/FrRJ3Z8)
|
||||
- [TheCyberMentor](https://discord.gg/)
|
||||
- [AshF0x - The F0xbox](https://discord.gg/RCTy5zS)
|
||||
- [The Mayor](https://discord.gg/EN2ya9h)
|
||||
- [Sup3rhero1](https://discord.gg/pHfgvns)
|
||||
- [Ceos3c](https://discord.gg/SBK3hkR)
|
||||
|
||||
## Misc
|
||||
- [ChaosComputerClub Germany Media Resources](https://media.ccc.de/) - bunch of conference talks and other media
|
||||
- [Phrack](http://www.phrack.org/)
|
||||
|
|
|
|||
|
|
@ -13,11 +13,14 @@ This section will help you set up your testing environement.
|
|||
- [Docker Tutorial for Beginners - A Full DevOps Course on How to Run Applications in Containers](https://www.youtube.com/watch?v=fqMOX6JJhGo) - freecodecamp
|
||||
- [Creating Wordlists for Pentesting & Bug Bounty](https://www.youtube.com/watch?v=QGbTaxtEQlg) - by nahamsec
|
||||
- [Setup bugbounty hunting env on termux](https://www.hahwul.com/2020/05/setup-bugbounty-hunting-env-on-termux-d.html?m=1) - by @hahwul
|
||||
- [Technical Project Ideas Towards Learning Cyber Security](https://mchow01.github.io/education/security/projects/2020/06/19/technical_projects_security.html) - by [Ming Y. Chow](https://mchow01.github.io/)
|
||||
## Burp Suite
|
||||
This section should help you get familiar with BurpSuite.
|
||||
- [Setting up Burp (Video Series)](https://www.hacker101.com/playlists/burp_suite) by Hacker101
|
||||
- [Burp Suite Introduction](https://github.com/bugcrowd/bugcrowd_university/blob/master/An_introduction_to_Burp_Suite/Bugcrowd%20University%20-%20Burp%20Suite%20Introduction.pdf) by Jason Haddix
|
||||
- [Beginners Guide to Burpsuite Payloads (Part 1)](https://www.hackingarticles.in/beginners-guide-burpsuite-payloads-part-1/) by Raj Chandel
|
||||
- [Burp Hacks for Bounty Hunters](https://www.youtube.com/watch?v=boHIjDHGmIo) by James Kettle
|
||||
## Tools
|
||||
- [Getting Starting With Tmux Isn't That Scary](https://www.youtube.com/watch?v=Z5sEEbwngd0)
|
||||
---
|
||||
back to [Intro Page](/README.md)
|
||||
|
|
@ -50,6 +50,8 @@ Here you can find links to a bunch of useful tools for Bug Bounty Hunting.
|
|||
|[crithit](https://github.com/codingo/crithit)|Takes a single wordlist item and tests it one by one over a large collection of hosts before moving onto the next. Create signatures to cross-check vulnerabilities over multiple hosts.|C++|[codingo](https://github.com/codingo)|
|
||||
|[nuclei](https://github.com/projectdiscovery/nuclei)|"Nuclei is a fast tool for configurable targeted scanning based on templates offering massive extensibility and ease of use."|Go|[ProjectDiscovery](https://github.com/projectdiscovery)|
|
||||
|[SpiderFoot](https://github.com/smicallef/spiderfoot)|SpiderFoot is an OSINT automation tool that queries over 100 data sources to build up a complete profile of your target, from host enumeration, to breached e-mail addresses and more.|Python|[SpiderFoot](http://twitter.com/spiderfoot)|
|
||||
|[subfinder](https://github.com/projectdiscovery/subfinder)|subfinder is a subdomain discovery tool that discovers valid subdomains for websites by using passive online sources. It has a simple modular architecture and is optimized for speed. subfinder is built for doing one thing only - passive subdomain enumeration, and it does that very well.|Go|[ProjectDiscovery](https://github.com/projectdiscovery)|
|
||||
|[SUBway](https://github.com/Sam-Lane/subway)|Enumerate subdomains by either using DNS lookup or by virtual hosting HTTP requests, useful for things like Hack The Box or Try Hack Me. SUBway requires a wordlist to use for subdomain discovery, SecLists is the recomended pairing for use with this tool.|Go|[Sam Lane](https://github.com/Sam-Lane)|
|
||||
|
||||
|
||||
#### OSINT Webpages
|
||||
|
|
@ -82,6 +84,7 @@ Here you can find links to a bunch of useful tools for Bug Bounty Hunting.
|
|||
|[Masscan](https://github.com/robertdavidgraham/masscan)|This is an Internet-scale port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second, from a single machine.|C|Robert David Graham|
|
||||
|[KeyHacks](https://github.com/streaak/keyhacks)|Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.|/|streaak|
|
||||
|[Nmap command helper](https://competent-goldberg-e5eefe.netlify.app/)|A tool that helps you with nmap commands. Has a build in training feature to help memorizing them.||0x0n0x|
|
||||
|[threader3000](https://github.com/dievus/threader3000)|Threader3000 is a script written in Python3 that allows multi-threaded port scanning. The program is interactive and simply requires you to run it to begin. Once started, you will be asked to input an IP address or a FQDN as Threader3000 does resolve hostnames. A full port scan should take less than 1 minute 30 seconds depending on your internet connection.|Python|[Joe Helle](https://github.com/dievus),[Tittimus](https://github.com/Sam-Lane),[plasticuproject](https://github.com/plasticuproject)|
|
||||
### Mobile Hacking
|
||||
| Name | Description | Written in | Created by |
|
||||
|------ |------------- | ------------ |------------- |
|
||||
|
|
@ -99,10 +102,11 @@ Here you can find links to a bunch of useful tools for Bug Bounty Hunting.
|
|||
|------ |------------- | ------------ |------------- |
|
||||
|[Reconness](https://github.com/reconness/reconness)|"ReconNess helps you to run and keep all your #recon in the same place allowing you to focus only on the potentially vulnerable targets without distraction and without required a lot of bash skill or programing skill in general."|C#|[Reconness](https://github.com/reconness)|
|
||||
|[Updog](https://github.com/sc0tfree/updog)|"Updog is a replacement for Python's SimpleHTTPServer. It allows uploading and downloading via HTTP/S, can set ad hoc SSL certificates and use HTTP basic auth."|Python|[sc0tfree](https://github.com/sc0tfree)|
|
||||
|[Notion](notion.so)|"Write, plan, collaborate, and get organized — all in one tool."||Notion Labs|
|
||||
|[Notion](https://notion.so)|"Write, plan, collaborate, and get organized — all in one tool."||Notion Labs|
|
||||
|[Joplin](https://joplinapp.org/)|"Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. The notes are searchable, can be copied, tagged and modified either from the applications directly or from your own text editor. The notes are in Markdown format."|JavaScript|Laurent Cozic|
|
||||
|[Xmind](https://www.xmind.net/)|XMind, a full-featured mind mapping and brainstorming tool, designed to generate ideas, inspire creativity, brings productivity in a remote WFH team.|/|XMind Ltd.|
|
||||
|[Axiom](https://github.com/pry0cc/axiom)|Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty and pentesting.|Bash|[@pry0cc](https://twitter.com/pry0cc)|
|
||||
|[PenTest.ws](https://pentest.ws/features)|PenTest.WS is a penetration testing web application for organizing hosts, services, vulnerabilities and credentials during a penetration test. A reporting module is available for documenting and delivering a full penetration test.||PenTest.ws|
|
||||
|
||||
### Others
|
||||
| Name | Description | Written in | Created by |
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue