├── Fuzz大法之挖掘潜在的逻辑越权.pdf ├── GET来的漏洞 _ WooYun知识库.pdf ├── README.md ├── SRC混子是怎样练成的.pdf ├── SSRF Bypass and Exploit.pptx ├── Security Assessment Mindset ├── API Testing MindMap.html ├── Bug Bountry Note.png ├── Finding Server Side Issues.png ├── IDOR.png ├── Oauth 2.0 Pentest Checklist.png ├── Patrik's Bug Bounty Tools.png ├── Recon Map.png ├── Recon-Masterplan.original.png ├── SSRF.png ├── Scope Based Recon Methodology Mindmap.png ├── Server_Side_Template injection Roadmap.png ├── The Bug Hunter’s Methodology v4 Roadmap.png ├── Web Penetration Tester Roadmap.png └── WindowsServer Mindmap.png ├── XS-Search.pptx ├── XSS-Cheat-Sheet-2019-Edition-2 翻译版本.pdf ├── nmap_cheet_sheet_0.6_2.pdf ├── 众测漏洞榜之脑洞篇.pptx ├── 众测经验谈.pptx ├── 信息收集.pptx ├── 区块链src.txt ├── 国内SRC漏洞挖掘技巧与经验分享.pdf ├── 我是如何挖各SRC漏洞的.pdf ├── 某SRC从源码泄露到getshell.pdf ├── 给开发者的终极XSS防护备忘录.pdf ├── 网盘泄露.docx ├── 论src漏洞挖掘的前期信息收集 .pptx ├── 边界渗透中的小技巧.pdf └── 面向企业src的漏洞挖掘.pdf /Fuzz大法之挖掘潜在的逻辑越权.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Fuzz大法之挖掘潜在的逻辑越权.pdf -------------------------------------------------------------------------------- /GET来的漏洞 _ WooYun知识库.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/GET来的漏洞 _ WooYun知识库.pdf -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # SRC-experience 2 | 工欲善其事，必先利其器 3 | 4 | ~~最近收集到的一些src挖掘奇技淫巧，然后还有一些国外新技术的学习网站分享给大家。~~ 5 | 6 | 2021.10.20: 时隔两年更新下文章。 7 | 8 | **Bug Bounty trick website** 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | **hackerone-reports** 18 | 19 | [hackerone-reports](https://github.com/reddelexc/hackerone-reports) 20 | 21 | [bug-bounty-reference 按漏洞性质分类的漏洞赏金记录列表](https://github.com/ngalongc/bug-bounty-reference) 22 | 23 | [BUG BOUNTY HUNTING](https://medium.com/bugbountywriteup/bug-bounty-hunting-methodology-toolkit-tips-tricks-blogs-ef6542301c65) 24 | 25 | [bounty-targets-data 赏金目标数据](https://github.com/arkadiyt/bounty-targets-data) 26 | 27 | [6000多份HackerOne漏洞公开报告](https://www.uedbox.com/post/65763/) 28 | 29 | [https://github.com/ngalongc/bug-bounty-reference](https://github.com/ngalongc/bug-bounty-reference) 30 | 31 | [Awesome-Bugbounty-Writeups](https://github.com/devanshbatham/Awesome-Bugbounty-Writeups) 32 | 33 | [https://github.com/w181496/Web-CTF-Cheatsheet](https://github.com/w181496/Web-CTF-Cheatsheet) 34 | 35 | [collection-of-bug-bounty-tip-will-be-updated-daily](https://medium.com/@vignesh4303/collection-of-bug-bounty-tip-will-be-updated-daily-605911cfa248) 36 | 37 | **Web-CTF-Cheatsheet** 38 | 39 | ```java 40 | https://github.com/w181496/Web-CTF-Cheatsheet 41 | https://github.com/harsh-bothra/learn365/ 42 | https://github.com/carlospolop/hacktricks 43 | ``` 44 | 45 | **Penetration** 46 | 47 | ```java 48 | BugBountyHunting Search Engine 49 | https://www.bugbountyhunting.com/ 50 | 51 | Bug Bounty Collection 52 | https://github.com/ngalongc/bug-bounty-reference 53 | https://github.com/djadmin/awesome-bug-bounty 54 | https://github.com/Muhammd/awesome-bug-bounty 55 | https://github.com/djadmin/awesome-bug-bounty 56 | https://github.com/dwisiswant0/awesome-oneliner-bugbounty 57 | https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters 58 | https://github.com/m4ll0k/Bug-Bounty-Toolz 59 | https://github.com/EdOverflow/bugbounty-cheatsheet 60 | https://github.com/KingOfBugbounty/KingOfBugBountyTips 61 | https://github.com/EdOverflow/bugbountyguide 62 | https://github.com/AlexisAhmed/BugBountyToolkit 63 | https://github.com/e11i0t4lders0n/Bugbounty-Resources 64 | 65 | https://github.com/sushiwushi/bug-bounty-dorks 66 | https://github.com/devanshbatham/Awesome-Bugbounty-Writeups 67 | https://github.com/1ndianl33t/Bug-Bounty-Roadmaps 68 | https://github.com/1ndianl33t/Bugbounty-Resources 69 | https://github.com/1ndianl33t/BugBounty_Profile 70 | https://github.com/KathanP19/HowToHunt 71 | https://github.com/vaib25vicky/awesome-mobile-security 72 | https://github.com/Voorivex/pentest-guide 73 | https://github.com/Hack-with-Github/Awesome-Hacking 74 | 75 | https://github.com/1hack0/Facebook-Bug-Bounty-Write-ups 76 | https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters 77 | https://github.com/0xedward/awesome-infosec 78 | https://github.com/victoni/Bug-Bounty-Scripts 79 | https://github.com/ujjwal96/arsenal 80 | https://github.com/Sambal0x/Recon-tools 81 | https://github.com/bobby-lin/bug-bounty-guide 82 | https://github.com/vavkamil/awesome-bugbounty-tools 83 | https://book.hacktricks.xyz 84 | 85 | https://github.com/1hack0/Facebook-Bug-Bounty-Write-ups 86 | https://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters 87 | https://github.com/0xedward/awesome-infosec 88 | https://github.com/victoni/Bug-Bounty-Scripts 89 | https://github.com/ujjwal96/arsenal 90 | https://github.com/Sambal0x/Recon-tools 91 | https://github.com/bobby-lin/bug-bounty-guide 92 | https://github.com/vavkamil/awesome-bugbounty-tools 93 | https://book.hacktricks.xyz 94 | 95 | https://github.com/infoslack/awesome-web-hacking 96 | https://github.com/jaredthecoder/awesome-vehicle-security 97 | https://github.com/trimstray/the-book-of-secret-knowledge 98 | https://github.com/CompassSecurity/Hacking_Tools_Cheat_Sheet 99 | https://github.com/The404Hacking/AndroRAT 100 | https://github.com/sundaysec/Android-Exploits 101 | https://github.com/AzimsTech/Android_Hacking 102 | https://github.com/hahwul/MobileHackersWeapons 103 | 104 | Cheat Sheet collection 105 | https://github.com/tanprathan/MobileApp-Pentest-Cheatsheet 106 | https://github.com/OlivierLaflamme/Cheatsheet-God 107 | https://github.com/baumanab/cheat_sheets 108 | https://github.com/detailyang/awesome-cheatsheet 109 | https://github.com/Kitsun3Sec/Pentest-Cheat-Sheets 110 | https://github.com/coreb1t/awesome-pentest-cheat-sheets 111 | https://gist.github.com/jeremypruitt/c435aefa2c2abaec02985d77fb370ec5 112 | https://github.com/PeterSufliarsky/pentesting-cheat-sheet 113 | 114 | Penetration Testing Checklist collection 115 | https://github.com/oxr463/pentesting-checklist 116 | https://github.com/netbiosX/Checklists 117 | https://github.com/harsh-kk/web-pentesting-checklist 118 | https://github.com/chennylmf/OWASP-Web-App-Pentesting-checklists 119 | https://github.com/MahdiMashrur/Awesome-Application-Security-Checklist 120 | https://github.com/Probely/security_checklist 121 | https://github.com/sderosiaux/checklists 122 | 123 | Pentesters Roadmap collection 124 | https://github.com/yeyintminthuhtut/Awesome-Red-Teaming 125 | https://github.com/GrandGarcon/Complete_Cybersecurity_Path 126 | https://github.com/CSIRT-MU/edu-resources 127 | https://github.com/argowang/cyber-security-roadmap 128 | https://github.com/Kennyslaboratory/Ultimate-Hacker-Roadmap 129 | https://github.com/nairuzabulhul/RoadMap 130 | https://github.com/nairuzabulhul/RoadMap/blob/master/PTS/Pentesting.md 131 | https://github.com/sundowndev/hacker-roadmap 132 | ``` 133 | 134 | **Payloads Collection** 135 | 136 | ```java 137 | Payloads Collection 138 | https://github.com/omurugur/SQL_Injection_Payload 139 | https://github.com/omurugur/XSS_Payload_List 140 | https://github.com/omurugur/OS_Command_Payload_List 141 | https://github.com/omurugur/Open_Redirect_Payload_List 142 | https://github.com/cujanovic/SSRF-Testing 143 | https://github.com/swisskyrepo/PayloadsAllTheThings 144 | 145 | https://github.com/akalankauk/XSS-SQL-Master-Payloads 146 | https://github.com/austinsonger/payloadsandlists 147 | https://github.com/BrodieInfoSec/BIG_XSS 148 | https://github.com/pgaijin66/XSS-Payloads 149 | https://github.com/sh377c0d3/Payloads 150 | https://github.com/omurugur/SQL_Injection_Payload 151 | https://github.com/RedVirus0/LFI-Payloads 152 | https://github.com/emadshanab/LFI-Payload-List 153 | https://github.com/secf00tprint/payloadtester_lfi_rfi 154 | 155 | https://github.com/foospidy/payloads 156 | https://github.com/payloadbox/command-injection-payload-list 157 | https://github.com/payloadbox/sql-injection-payload-list 158 | https://github.com/payloadbox/open-redirect-payload-list 159 | https://github.com/payloadbox/xxe-injection-payload-list 160 | https://github.com/payloadbox/rfi-lfi-payload-list 161 | https://github.com/payloadbox/csv-injection-payloads 162 | https://github.com/terjanq/Tiny-XSS-Payloads 163 | https://github.com/hahwul/XSS-Payload-without-Anything 164 | ``` 165 | 166 | **Awesome Electron.js hacking** 167 | 168 | ```java 169 | https://github.com/doyensec/awesome-electronjs-hacking 170 | ``` 171 | 172 | **从别的地方扒来一些案例和知识点** 173 | 174 | [浅析通过"监控"来辅助进行漏洞挖掘](https://bbs.ichunqiu.com/thread-28591-1-1.html) 175 | 176 | [威胁情报-生存在SRC平台中的刷钱秘籍](https://bbs.ichunqiu.com/article-921-1.html) 177 | 178 | [威胁情报](https://mp.weixin.qq.com/s/v2MRx7qs70lpnW9n-mJ7_Q) 179 | 180 | [YSRC众测之我的漏洞挖掘姿势](https://bbs.ichunqiu.com/article-655-1.html) 181 | 182 | [SRC的漏洞分析](https://bbs.ichunqiu.com/thread-19745-1-1.html) 183 | 184 | [众测备忘手册](https://mp.weixin.qq.com/s/4XPG37_lTZDzf60o3W_onA) 185 | 186 | [挖洞技巧：如何绕过URL限制](https://www.secpulse.com/archives/67064.html) 187 | 188 | [挖洞技巧：APP手势密码绕过思路总结](https://www.secpulse.com/archives/67070.html) 189 | 190 | [挖洞技巧：支付漏洞之总结](https://www.secpulse.com/archives/67080.html) 191 | 192 | [挖洞技巧：绕过短信&邮箱轰炸限制以及后续](http://mp.weixin.qq.com/s/5OSLC2GOeYere9_lT2RwHw) 193 | 194 | [挖洞技巧：信息泄露之总结](https://www.secpulse.com/archives/67123.html) 195 | 196 | [OSS对象存储上传解析漏洞](https://xianzhi.aliyun.com/forum/topic/2078) 197 | 198 | [任意文件下载引发的思考](https://www.secpulse.com/archives/68522.html) 199 | 200 | [两种密码重置之综合利用](http://www.freebuf.com/articles/network/166520.html) 201 | 202 | [任意用户密码重置](http://www.freebuf.com/articles/web/166667.html) 203 | 204 | [通用性业务逻辑组合拳劫持你的权限](https://www.anquanke.com/post/id/106961) 205 | 206 | **收藏的 src 工具** 207 | 208 | [Scanners-Box 安全行业从业者自研开源扫描器合辑](https://github.com/We5ter/Scanners-Box) 209 | 210 | [hakrawler-快速地发现Web应用程序中的端点和资产](https://github.com/hakluke/hakrawler) 211 | 212 | [Voyager-安全工具集合平台](https://github.com/ody5sey/Voyager) 213 | 214 | [bayonet-src资产管理系统](https://github.com/CTF-MissFeng/bayonet) 215 | 216 | [wayback-machine-downloader](https://github.com/hartator/wayback-machine-downloader) 217 | 218 | [ApkAnalyser-一键提取安卓应用中可能存在的敏感信息](https://github.com/TheKingOfDuck/ApkAnalyser) 219 | 220 | [Diggy-从apk文件中提取端点](https://github.com/s0md3v/Diggy) 221 | 222 | 223 | **新的一年祝大家挖洞必高危。** 224 | -------------------------------------------------------------------------------- /SRC混子是怎样练成的.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/SRC混子是怎样练成的.pdf -------------------------------------------------------------------------------- /SSRF Bypass and Exploit.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/SSRF Bypass and Exploit.pptx -------------------------------------------------------------------------------- /Security Assessment Mindset/API Testing MindMap.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Markmap 8 | 19 | 20 | 21 | 22 | 23 | 24 | 25 | 26 | -------------------------------------------------------------------------------- /Security Assessment Mindset/Bug Bountry Note.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Bug Bountry Note.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Finding Server Side Issues.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Finding Server Side Issues.png -------------------------------------------------------------------------------- /Security Assessment Mindset/IDOR.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/IDOR.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Oauth 2.0 Pentest Checklist.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Oauth 2.0 Pentest Checklist.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Patrik's Bug Bounty Tools.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Patrik's Bug Bounty Tools.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Recon Map.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Recon Map.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Recon-Masterplan.original.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Recon-Masterplan.original.png -------------------------------------------------------------------------------- /Security Assessment Mindset/SSRF.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/SSRF.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Scope Based Recon Methodology Mindmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Scope Based Recon Methodology Mindmap.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Server_Side_Template injection Roadmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Server_Side_Template injection Roadmap.png -------------------------------------------------------------------------------- /Security Assessment Mindset/The Bug Hunter’s Methodology v4 Roadmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/The Bug Hunter’s Methodology v4 Roadmap.png -------------------------------------------------------------------------------- /Security Assessment Mindset/Web Penetration Tester Roadmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/Web Penetration Tester Roadmap.png -------------------------------------------------------------------------------- /Security Assessment Mindset/WindowsServer Mindmap.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/Security Assessment Mindset/WindowsServer Mindmap.png -------------------------------------------------------------------------------- /XS-Search.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/XS-Search.pptx -------------------------------------------------------------------------------- /XSS-Cheat-Sheet-2019-Edition-2 翻译版本.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/XSS-Cheat-Sheet-2019-Edition-2 翻译版本.pdf -------------------------------------------------------------------------------- /nmap_cheet_sheet_0.6_2.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/nmap_cheet_sheet_0.6_2.pdf -------------------------------------------------------------------------------- /众测漏洞榜之脑洞篇.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/众测漏洞榜之脑洞篇.pptx -------------------------------------------------------------------------------- /众测经验谈.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/众测经验谈.pptx -------------------------------------------------------------------------------- /信息收集.pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/信息收集.pptx -------------------------------------------------------------------------------- /区块链src.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/区块链src.txt -------------------------------------------------------------------------------- /国内SRC漏洞挖掘技巧与经验分享.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/国内SRC漏洞挖掘技巧与经验分享.pdf -------------------------------------------------------------------------------- /我是如何挖各SRC漏洞的.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/我是如何挖各SRC漏洞的.pdf -------------------------------------------------------------------------------- /某SRC从源码泄露到getshell.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/某SRC从源码泄露到getshell.pdf -------------------------------------------------------------------------------- /给开发者的终极XSS防护备忘录.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/给开发者的终极XSS防护备忘录.pdf -------------------------------------------------------------------------------- /网盘泄露.docx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/网盘泄露.docx -------------------------------------------------------------------------------- /论src漏洞挖掘的前期信息收集 .pptx: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/论src漏洞挖掘的前期信息收集 .pptx -------------------------------------------------------------------------------- /边界渗透中的小技巧.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/边界渗透中的小技巧.pdf -------------------------------------------------------------------------------- /面向企业src的漏洞挖掘.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Wh0ale/SRC-experience/e3685c526f2681508a93a6e5c12a0273b4590d94/面向企业src的漏洞挖掘.pdf --------------------------------------------------------------------------------