Web_Hacking/README.md

Web Hacking + Bug Bounty Tricks

These are my Bug Bounty / Pentest notes that I have gathered from various sources.

You can also contribute.

List of Vulnerabilities

• API Key Leak
• CRLF Injection
• CSRF
• Cache Poisoning / Deception
• DOM Clobbering
• File Inclusion
• File Upload
• GraphQL
• Host Header Injection
• IDOR
• JWT
• NoSQLi
• Open Redirect
• Race Condition
• Reverse Tab Nabbing
• SQLi
• SSRF
• XSS
• XXE

Bypass Techniques

• 2FA / OTP Bypass
• 403 Bypass
• 429 Bypass
• Captcha Bypass
• CSP Bypass
• Login Bypass
• Rate Limit Bypass
• Reset Password Bypass
• WAF Detect / Bypass

Recon & OSINT Techniques

• Recon
• OSINT

Top Tools & Extensions

• inql - Burp extension for advanced GraphQL testing
• Logger++ - Burp extension, a multithreaded logging extension for Burp Suit
• param-miner - Burp extension, identifies hidden, unlinked parameters

Mindmaps for Bug Hunters

• XXE
• SSRF
• CORS
• Prototype Pollution

Secure Coding

• 2FA
• Password Reset
• Session Fixation
• Broken Object Level Authorization - API1:2023
• Broken Authentication - API2:2023
• Broken Object Property Level Authorization - API3:2023

---

All content of this repository will always be updated...