JakobTheDev/bug-bounty

Environment

My basic testing environment includes:

• Docker container (see Dockerfile)
• Standard config (see my config repo)
• BurpSuite
• Firefox
• Terminal

Methodology

• Choose a Program
• Recon

Bug Classes

• SQLi
• XSS

Polyglots

• XSS

Notes

• Environment
• Learning
• Jason Haddix 15 Minute Assessment

Recon Workflow

Below is a summary of my reconnaissance workflow. More details about the workflow and example commands can be found on the recon page.

Tips

• Create a separate Chrome profile / Google account for Bug Bounty. Create dedicated BB accounts for YouTube etc. so you can get only relevant recommended content.
• However you do it, set up an environment that has all the tools you use, all the time.
• Use aliases and bash scripts to simplify commands you use all the time.

Resources

Guides

• Self-Hosted Burp Collaborator - ROT

Lists

• Awesome Bug Bounty

Methodology

• How to Shot Web: Web and mobile hacking in 2015 - Jason Haddix
• The Art of Subdomain Enumeration - Appsecco

Tooling

• Bug Bounty Toolkit