Bug Bounty Methodology Checklist

This repository contains a comprehensive methodology and checklist for bug bounty hunting, covering recon, enumeration, and exploitation techniques. It is designed to assist security researchers and penetration testers in systematically identifying vulnerabilities in web applications, networks, and infrastructure.

Table of Contents

1. Recon Phase
   • Large Scope
   • Medium Scope
   • Small Scope
2. Network Recon
3. User Management
   • Registration
   • Authentication
4. Session Management
5. Input Handling
6. Error Handling
7. Application Logic
8. Other Checks
   • CAPTCHA Bypass
   • Security Headers

---

Recon Phase

Large Scope: Company with Multiple Domains

• Get ASN for IP ranges using:
  • Amass, Asnlookup, Metabigor, BGP
• Review latest acquisitions
• Get registrant relationships:
  • ViewDNS
• Move to "Medium Scope" for each domain

Medium Scope: Single Domain

• Enumerate subdomains:
  • Amass, Subfinder
• Subdomain bruteforce:
  • PureDNS, Wordlist
• Subdomain permutation:
  • Gotator, Ripgen
• Identify live subdomains:
  • Httpx
• Subdomain takeover check:
  • Nuclei Takeovers
• Cloud asset discovery:
  • CloudEnum
• Screenshot subdomains:
  • Gowitness, Aquatone

Small Scope: Single Website

• Identify web server and tech stack:
  • Httpx
• Locate common files like /robots.txt, /sitemap.xml, etc.
• Source code review (using comments):
  • Burp Suite Engagement Tools
• Directory enumeration:
  • FFUF, OneListForAll Wordlist
• Web fuzzing:
  • FFUF
• Discover URLs and APIs:
  • Gau, Waybackurls
• Test CORS vulnerabilities:
  • CORScanner, Corsy

---

Network Recon

• Check DMARC/SPF policies:
  • SpoofCheck
• Port scanning (all ports):
  • Nmap
• UDP port scanning:
  • Udp-proto-scanner
• SSL/TLS testing:
  • TestSSL

---

User Management

Registration

• Test for duplicate registrations (e.g., user+1@mail.com)
• Check for weak password policies
• Rate-limiting on registration

Authentication

• Test username enumeration
• Test for brute-force resilience
• Test multi-stage authentication (OAuth, SAML, JWT)

---

Session Management

• Test session fixation
• Test CSRF tokens
• Validate secure cookies (HTTPOnly, Secure)
• Check session expiration on logout

---

Input Handling

• Test for Reflected XSS:
  • Dalfox
• Test for SQL Injection:
  • SQLmap
• Test for Server-Side Request Forgery (SSRF):
  • Gopherus
• Test for Local File Inclusion (LFI)

---

Error Handling

• Generate and analyze custom error pages
• Test HTTP header injection
• Use fuzzing techniques to generate error codes:
  • Burp Suite

---

Application Logic

• Test for multi-step process logic flaws (e.g., gift codes, payments)
• Test for client-side validation bypass
• IDOR checks (access control for sensitive resources)

---

Other Checks

CAPTCHA Bypass

• Bypass CAPTCHA using OCR tools:
  • Tesseract OCR

Security Headers

• Check for missing headers like:
  • X-XSS-Protection, Strict-Transport-Security, Content-Security-Policy, X-Frame-Options

---

Contributing

Feel free to submit a pull request if you find additional tools, techniques, or methodologies that should be included. We welcome all contributions from the bug bounty community!

---

This checklist provides a systematic approach to finding and exploiting vulnerabilities in bug bounty programs. It serves as a quick reference to ensure you cover all critical aspects during your testing process.