daffainfo/allaboutbugbounty

AllAboutBugBounty is a personal reference collection on bug bounty hunting, which is the practice of finding and reporting security vulnerabilities in websites and applications in exchange for rewards. The repository gathers notes on common web vulnerabilities, techniques for bypassing security controls, and checklists for testing specific features, aimed at security researchers who participate in bug bounty programs. The vulnerability section covers a range of attack types that frequently appear in bug bounty targets. These include cross-site scripting, SQL injection, server-side request forgery, insecure direct object references, open redirects, file upload flaws, CSRF, and about a dozen others. Each topic links to a separate document with more detail on how that vulnerability works and what payloads or techniques are used to test for it. A bypass section focuses specifically on circumventing server-side restrictions: getting past 403 Forbidden responses, rate-limit 429 errors, CAPTCHA checks, and two-factor authentication controls. A reconnaissance section covers search techniques using Google, GitHub, and Shodan to find information about targets before testing begins. There are also notes on specific technologies such as WordPress, Jenkins, Nginx, Confluence, Laravel, and others, covering vulnerabilities and misconfigurations specific to each platform. A miscellaneous section covers topics like account takeover scenarios, JWT token vulnerabilities, email spoofing, and business logic errors. The repository is structured as a set of linked Markdown files rather than a polished guide. It was created from notes gathered from various external sources and is open to community contributions. As of the README, some sections were still marked as coming soon.