Bug Bounty Hunting

  1. Reconnaissance and Information Gathering
    1. Passive Information Collection
      1. Domain Intelligence
        1. WHOIS Database Queries
          1. Registrant Information
            1. Registration History
              1. Expiration Dates
              2. DNS Record Analysis
                1. A and AAAA Records
                  1. MX Records
                    1. TXT Records
                      1. CNAME Records
                        1. NS Records
                          1. SOA Records
                        2. Certificate Analysis
                          1. Certificate Transparency Logs
                            1. Subdomain Discovery
                              1. Certificate History
                                1. Issuer Information
                                2. SSL/TLS Certificate Details
                                  1. Subject Alternative Names
                                    1. Certificate Chains
                                  2. Search Engine Intelligence
                                    1. Google Dorking
                                      1. Site-Specific Searches
                                        1. File Type Searches
                                          1. Sensitive Information Discovery
                                          2. Specialized Search Engines
                                            1. Shodan
                                              1. Censys
                                                1. ZoomEye
                                              2. Social Engineering Reconnaissance
                                                1. Social Media Analysis
                                                  1. LinkedIn Profiles
                                                    1. Twitter Information
                                                      1. Facebook Data
                                                      2. Code Repository Mining
                                                        1. GitHub Searches
                                                          1. GitLab Analysis
                                                            1. Bitbucket Investigation
                                                              1. Exposed Credentials
                                                          2. Active Information Gathering
                                                            1. Subdomain Discovery
                                                              1. Brute Force Enumeration
                                                                1. Wordlist Selection
                                                                  1. Custom Wordlists
                                                                  2. Certificate Scraping
                                                                    1. DNS Zone Transfers
                                                                      1. Third-Party APIs
                                                                        1. VirusTotal
                                                                          1. SecurityTrails
                                                                        2. Network Reconnaissance
                                                                          1. Port Scanning Techniques
                                                                            1. TCP Connect Scans
                                                                              1. SYN Scans
                                                                                1. UDP Scans
                                                                                  1. Nmap Usage and Options
                                                                                  2. Service Detection
                                                                                    1. Version Detection
                                                                                      1. OS Fingerprinting
                                                                                        1. Script Scanning
                                                                                      2. Web Application Fingerprinting
                                                                                        1. Technology Stack Identification
                                                                                          1. Wappalyzer Analysis
                                                                                            1. WhatWeb Scanning
                                                                                              1. Manual Header Analysis
                                                                                              2. Framework Detection
                                                                                                1. CMS Identification
                                                                                                  1. Programming Language Detection
                                                                                                2. Content Discovery
                                                                                                  1. Directory Enumeration
                                                                                                    1. Dirb Usage
                                                                                                      1. FFUF Techniques
                                                                                                        1. Gobuster Implementation
                                                                                                        2. File Discovery
                                                                                                          1. Backup File Detection
                                                                                                            1. Log File Identification
                                                                                                            2. Parameter Discovery
                                                                                                              1. GET Parameter Fuzzing
                                                                                                                1. POST Parameter Discovery
                                                                                                              2. API Reconnaissance
                                                                                                                1. Endpoint Discovery
                                                                                                                  1. Swagger/OpenAPI Documentation
                                                                                                                    1. API Fuzzing Techniques
                                                                                                                      1. GraphQL Introspection
                                                                                                                      2. Authentication Mechanism Analysis
                                                                                                                        1. Token-Based Authentication
                                                                                                                          1. API Key Usage
                                                                                                                            1. OAuth Implementation

                                                                                                                      Previous

                                                                                                                      4. Bug Hunting Methodology

                                                                                                                      Go to top

                                                                                                                      Next

                                                                                                                      6. Web Application Vulnerabilities