awesome-repos

KO | EN

gitlite — search

#hacktoberfest #ai #android #rust #linux #nodejs #macos #java #vue #pytorch #mcp #ios #openai #open-source

(★ 51)

Repositories, Links, Payloads, Blogs, Tools, etc.. which I think might be useful for pentesting and bug bounty

파일 탐색기

최종 버전 다운로드 (.zip)

README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

![Awesome-Repos.png](https://i.postimg.cc/XJS9Pxkq/cooltext419648344128693.png)

### Getting Started

All you need to kickstart bug hunting.

1. [If all current bug bounty knowledge is gone, how to get it back and make $100k in the first year](https://x.com/Rhynorater/status/1699395452481769867) by [Justin Gardner](https://x.com/Rhynorater)
1. [So, you want to get into bug bounties?](https://shubs.io/so-you-want-to-get-into-bug-bounties/) by [infosec_au](https://twitter.com/infosec_au)
1. [How to get into bug bounties](https://0xprial.com/how-to-get-into-bug-bounties-part-01/) by [0xprial](https://twitter.com/0xPrial)
1. [Resources for beginners](https://rhynorater.github.io/Beginners-Resources) by [rhynorater](https://twitter.com/rhynorater)
1. [Roadmap](https://securityflow.io/roadmap/) - an Excellent roadmap designed for all levels. Junior, Medior, and Senior. You can follow the suggested topics to visualize the obstacles in front of you that you should bypass to become a successful Security Researcher. by [HolyBugx](https://twitter.com/HolyBugx)
1. [So you want to be a web security researcher?](https://portswigger.net/research/so-you-want-to-be-a-web-security-researcher) by [James Kettle](https://twitter.com/albinowax)
1. [A Graduate’s Thoughts: How to Get Started in Information Security and Cyber Security](https://medium.com/heck-the-packet/a-graduates-thoughts-how-to-get-started-in-information-security-and-cyber-security-d01a1efaed0f)
1. [Tip's from a hunter who got his first bounty - A must read for every beginner](https://twitter.com/sshbounty/status/1569246801710006272?s=20&t=-SydvYKsLEzGEEWIdhhfOg) by [rahmetu](https://twitter.com/sshbounty)
1. [Reflecting on 2 Years of Bug Bounty](https://h1pmnh.github.io/post/2022-sep-2-years-bug-bounty/?utm_source=newsletter&utm_medium=email&utm_campaign=bug_bytes_177_hackers_descend_on_ahmedabad_the_hardest_ctf_and_tales_of_easy_p1s&utm_term=2022-10-12) by [pmnh](https://twitter.com/pmnh_)
1. [Prerequisite knowledge before starting to learn about web vulns](https://twitter.com/rhynorater/status/1588200181132042240) by [Justin](https://twitter.com/Rhynorater)
1. [Technical tips after completing 1 year in bug bounty](https://x.com/jusxing/status/1949860504580632979) by [jusxing](https://x.com/jusxing)

### Payloads

Some interesting payloads available public, which you can use for various scenarios

1. [sh377c0d3/Payloads](https://github.com/sh377c0d3/Payloads) - Contains payloads based on various bug types, by [sh377c0d3](https://twitter.com/sh377c0d3)
2. [danielmiessler/SecLists](https://github.com/danielmiessler/SecLists) - SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place. by
3. [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) - A list of useful payloads and bypasses for Web Application Security.
4. Super wordlists - https://github.com/fuzz-security/SuperWordlist
5. [random-robbie/bruteforce-lists](https://github.com/random-robbie/bruteforce-lists) - Some files for bruteforcing certain things
6. [CommonSpeak wordlists](https://github.com/pentester-io/commonspeak) - Wordlist generated from a tool that leverages public datasets from Google's BigQuery platform.
7. [OneListForAll](https://github.com/six2dez/OneListForAll) - Project to generate huge wordlists for web fuzzing, by [Six2dez1](https://twitter.com/Six2dez1)

### Tools

List of interesting tools available for shooting. Also [here](https://github.com/stars/glaucusec/lists/interesting-tools) is the `github list` containing all the interesting tools I have come across

1. [Wapiti](https://github.com/IFGHou/wapiti) - Wapiti is a web application security auditor.
2. [Bug-Bounty-Toolz](https://github.com/m4ll0k/Bug-Bounty-Toolz) - A repo contains personal scripts and tools by [m4ll0k](https://twitter.com/m4ll0k)
3. [puredns](https://github.com/d3mondev/puredns) - fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.
4. [Rengine](https://github.com/yogeshojha/rengine) - Recon framework and does end to end recon
5. [BBRF](https://blog.intigriti.com/2021/06/22/hacker-tools-bbrf-organizing-your-recon/) - A tool to organize your recon information in a centralized way.
6. [Nuclei](https://github.com/projectdiscovery/nuclei) - Fast and customizable vulnerability scanner based on simple YAML based DSL.
7. [mimproxy](https://mitmproxy.org/) - `mitmproxy` is a free and open source interactive HTTPS proxy. A proxy tool that can replace burp and helps in building tools
8. [Armanda](https://github.com/resyncgg/armada) - A high performance TCP [Reconftw](https://github.com/six2dez/reconftw) - reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities by [six2dez](https://twitter.com/six2dez1)
9. [WhatWaf](https://github.com/Ekultek/WhatWaf) - an advanced firewall detection tool who's goal is to give you the idea of "There's a WAF?"
10. [GitTools](https://github.com/internetwache/GitTools) - Find websites with .git files
11. [page-fetch](https://github.com/detectify/page-fetch) - Fetch web pages using headless Chrome, storing all fetched resources including JavaScript files. Run arbitrary JavaScript on many web pages and see the returned values

### Automation

Some tools and scripts which can help automate various phases of security testing.

1. [discover](https://github.com/leebaird/discover) - Custom bash scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and creating malicious payloads using Metasploit.
2. [Bug Bounty Oneliners](https://github.com/dwisiswant0/awesome-oneliner-bugbounty) - A collection of awesome one-liner scripts especially for bug bounty tips.
3. [Hakluke: Creating the Perfect Bug Bounty Automation](https://labs.detectify.com/2021/11/30/hakluke-creating-the-perfect-bug-bounty-automation/) by [Hakluke](https://twitter.com/hakluke/)
4. [pentest-tools](https://github.com/gwen001/pentest-tools) - A collection of tools by [gwendallecoguic](https://twitter.com/gwendallecoguic)
5. [Rengine](https://github.com/yogeshojha/rengine) - Recon framework and does end to end recon
6. [BBRF](https://blog.intigriti.com/2021/06/22/hacker-tools-bbrf-organizing-your-recon/) - A tool to organize your recon information in a centralized way.

### Projects

Collection of project ideas which can help improve programming skills by completing real projects.

1. [100-redteam-projects](https://github.com/kurogai/100-redteam-projects) - A list of projects for pentesters and network managers

### References, Tricks and Tutorials.

1. [Hackikng with CURL](https://github.com/frizb/HackingWithCurl) - A list of examples and references of hacking with Bash and the Curl command
2. [Great OWASP Top 10 Referece](https://github.com/OWASP/wstg/tree/master/document)
3. [BugBounty Mind-Maps](https://github.com/imran-parray/Mind-Maps)

### Vulnerable Apps

Vulnerable apps which can tested for practicing the vulnerabilities learned.

1. [Awesome vulnerable apps](https://github.com/vavkamil/awesome-vulnerable-apps) - A curated list of various vulnerable by design applications
2. [Gin and Juice Shop](https://portswigger.net/blog/gin-and-juice-shop-put-your-scanner-to-the-test) by [Portswigger](https://portswigger.net/)

### Twitter Threads

Useful twitter threads from various researchers and companies

1. [How to use Autorepeater](https://twitter.com/ngkogkos/status/1350498063555719175?s=19)
2. [Cheatsheets and Checklists](https://twitter.com/e11i0t_4lders0n/status/1403046199091863554?s=19)
3. [Burpsuite tips and tricks](https://twitter.com/codingo_/status/1394276284889370625?s=19)
4. [Source code review Tips](https://twitter.com/infosec_au/status/1512604377001127941?t=cIMNYxw1vNj5HpPR5QapTA&s=19) by [infosec_au](https://twitter.com/infosec_au)
5. [Maximize your luck of finding a bug](https://twitter.com/rez0__/status/1553371598085840898?t=p4PMlHPtoH2E0jbPWHsi0g&s=19)
6. [10 Common Mistakes to avoid in bugbounty](https://twitter.com/0xManan/status/1613505603858747398?ref=the-infosec-newsletter) by [Manan](https://twitter.com/0xManan)

### Mental Health

1. [Bug Bounties and Mental Health](https://medium.com/@NathOnSecurity/bug-bounties-and-mental-health-40662b2e497b)
2. [Things to do—and avoid doing—when contacting and working with a mentor](https://twitter.com/danielmiessler/status/1616200314478276608) by [Daniel Miessler](https://twitter.com/DanielMiessler)

### Onward & Upward

1. [How to turn security research into profit: a CL.0 case study](https://portswigger.net/research/how-to-turn-security-research-into-profit)
2. [From Researcher to Engineer and Beyond](https://whitton.io/articles/from-researcher-to-engineer-and-beyond/)

### Misc

1. [The 10 rules to be successful in your bug bounty career ](https://webs3c.com/t/the-10-rules-to-be-successful-in-your-bug-bounty-career/123) by [arl_rose](https://twitter.com/Arl_rose)
2. [What To Do When You're Stuck Hacking](https://www.hackerone.com/blog/What-To-Do-When-You-Are-Stuck-Hacking)
3. [How to Make Your Goals Achievable](https://www.mindtools.com/pages/article/smart-goals.htm)
4. [Explore Farnam Street Articles](https://fs.blog/blog/) - Help you master the best of what other people have already figured out.
5. [Bug bounty hunter to working at Microsoft ](https://microsoftedge.github.io/edgevr/posts/bug-bounty-hunter-to-working-at-microsoft/)
6. [Asking good questions](https://jvns.ca/blog/good-questions/)
7. [How to get useful answers to your questions](https://jvns.ca/blog/2021/10/21/how-to-get-useful-answers-to-your-questions/) by [Julia Evans](https://twitter.com/b0rk)
8. [How to answer questions in a helpful way](https://jvns.ca/blog/answer-questions-well/) by [Julia Evans](https://twitter.com/b0rk)
9. [Luck VS HardWork](https://jamesclear.com/luck-vs-hard-work)
10. [How to Create Luck](https://www.swyx.io/create-luck)
11. [Career Advice and Professional Development](https://www.philvenables.com/post/career-advice-and-professional-development)

awesome-repos

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

awesome-repos

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README