#bugbountytips

🔍 SwaggerSpy: Automated OSINT for API Intelligence

Looking for exposed secrets in API documentation? Meet SwaggerSpy - an OSINT tool that crawls SwaggerHub for publicly exposed API specs and uses regex patterns to extract:

● Hardcoded API keys and tokens
● Database credentials
● Internal endpoints and architecture details
● Authentication secrets
● AWS keys, JWT tokens, and more

Quick Start:

python3 swaggerspy.py example.com

Pro Tips:

1. Combine findings with subdomain enumeration
2. Check for versioned APIs (v1, v2, etc.)
3. Look for staging/dev environments in documentation

#bugbountytips

🔍 Quick Win: Git Exposure → Secret Hunting 🔥

Step 1: Mass Git Config Hunt

nuclei -l alive_http_services.txt -id git-config

Step 2: Dump the repository

git-dumper https://target.com/ output/

Step 3: Hunt for secrets in dumped code

nuclei -u output/ -file

Jackpot:

- SaaS Keys in config files
- DB credentials in .env
- Internal API docs with admin endpoints

Lesson: Never stop at initial finding - always dig deeper! 🚀

https://www.youtube.com/watch?v=08sbpY0USqg&t=1058s

#bugbountytips

Want to report a scanner finding, but feel like writing it up is too tedious? 😅

Install the ReportLM extension and get Burp AI to do it for you!

Prompt example:

Generate a bug bounty report, outlining the finding summary, impact, provide full HTTP requests and CVSS scoring

#bugbountytips

If you need to generate a target-specific wordlist, make sure to check out GAP extension.

It will scan for sus parameters and generate you a complete wordlist with one click of a button.

#bugbountytips

Cloudflare has recently started blocking proxy tools such as Burp Suite by detecting their unique TLS and request fingerprints.

If you encounter this issue, install the "Bypass Bot Detection" extension from the BApp Store. It spoofs Burp’s TLS fingerprint to resemble normal browser traffic and bypass the block.

https://github.com/PortSwigger/bypass-bot-detection

#bugbountytips

If you found a package.json file in the wild, you might find some internal packages vulnerable to a dependency confusion attack 👀

Check for it quicker using this cool new tool by JSMon:

https://app.jsmon.sh/tools/npm-validator/

#bugbountytips

Found an XSS but got blocked by the CSP?

https://cspbypass.com has a compiled list of ways to bypass the Content-Security Policy. Check out the video.

#bugbountytips

🎯 CSP Takeover Hunting

Content-Security-Policy (CSP) whitelists trusted hosts for scripts/resources — but if a whitelisted domain is vulnerable to subdomain takeover (expired DNS, dangling CNAME, abandoned cloud service), an attacker can host malicious assets and bypass CSP.

How to find them:

Use cspgrabber - to extract domains/subdomains from CSP headers across your targets, then feed results to Nuclei’s subdomain-takeovers profile to detect takeovers that could bypass CSP.

One-liner example:

./cspgrabber -f alive_http_services.txt -c 40 -rps 120 -clean -o csp_domains.txt && \
nuclei -l csp_domains.txt -profile subdomain-takeovers -nh -o takeovers.txt

#bugbountytips

Not many know this: nuclei's param fuzzing skips a parameter after the first 10 payloads that return nothing.
So if the initial 10 tries don't trigger anything, that parameter gets ignored and you might miss interesting cases.

How to fix it: use -fuzz-param-frequency. It controls how many "uninteresting" payloads are allowed before nuclei skips a parameter (default is 10).

nuclei -h | grep frequency

...
-fuzz-param-frequency int           frequency of uninteresting parameters for fuzzing before skipping (default 10)

An example of an automated pipeline (katana + nuclei) for fuzzing:

katana -u http://testphp.vulnweb.com -aff -iqp -j -o katana.jsonl && \
nuclei -l katana.jsonl -im jsonl -dast -fuzz-param-frequency 10000

Why this matters:

• Some endpoints only respond on later payloads (rate-limited, WAF behavior, timing issues).
• Increasing the frequency prevents skipping noisy-but-interesting params.
• Use with care — raising it a lot increases runtime and requests.

#bugbountytips

TLS-Based Recon for Attack Surface

Here's a fast and effective recon flow to find and scan hidden assets using TLS certificate metadata and Shodan dorking via Nuclei’s built-in Uncover engine.

Step 1: Find subdomains with subfinder and use tlsx to extract TLS certificate metadata:

subfinder -d tesla.com | tlsx -nc -silent -so | awk '{for(i=2; i<=NF; i++) printf "%s ", $i; print ""}'| tr -d '[],' | sort -uf

📌 This gives you organization names from TLS certificates:

- Tesla Motors Inc.
- Microsoft Corporation
- Akamai Technologies Inc.

Step 2: Use Nuclei's Uncover engine to automatically pull targets from Shodan using a dork with org name, and scan them:

export SHODAN_API_KEY=your_key_here && \

nuclei -rl 300 -nc -uc -ue -ul 10000 -uq 'org:"Tesla Motors Inc"' -silent

💡More about Uncover — How to use Uncover: Quickly discover exposed hosts using multiple search engines

#bugbountytips

12 useful firefox extensions for bugbounty 💵

1. Trufflehog - Detecting hidden API keys, tokens and secrets on websites.

2. Wappalyzer - Identify technologies on websites.

3. DotGit - An extension to check if .git is exposed in visited websites.

4. FindSomething - Find interesting things in the webpage's source code or JavaScript.

5. Fake Filler - A form filler that fills all form inputs (textboxes, textareas, radio buttons, dropdowns, etc.) with fake and randomly generated data.

6. WaybackURL - Fetched archived URLs from the Wayback Machine.

7. Open Multiple URLs - Opens a list of URLs and optionally extracts URLs from text.

8. Link Gopher - Extracts all links from web page, sorts them, removes duplicates, and displays them in a new tab.

9. Temp Mail - Temporary disposable email address.

10. Shodan - Plugin tells you where the website is hosted (country, city), who owns the IP and what other services/ports are open.

11. Favicon Hash for Shodan - Generates MurmurHash3 hash from website favicon. Compliant with hashing method used by Shodan Search Engine (shodan.io). Useful for OSINT investigations and reconnaissances.

12. Edit Cookie - Edit cookies related to the current page.

#bugbountytips

Additionally, there are already several ready-to-use prompt collections available, so you can start generating templates immediately without creating prompts from scratch:

1. https://github.com/reewardius/Nuclei-AI-Prompts
2. https://github.com/huseyinstif/Nuclei-AI-Prompts
3. https://nucleiprompts.com/

#bugbountytips

Nuclei AI Prompts enables security researchers to quickly generate Nuclei templates using AI. Instead of manually writing YAML templates for vulnerabilities, you simply provide a description, and a fully structured template ready for use with Nuclei is generated automatically.

To get started with Nuclei AI Prompts, first obtain an API token from ProjectDiscovery. Then, run Nuclei with the -auth flag and add your token.

Example usage:

nuclei -auth
nuclei -list targets.txt -ai "Extract page title, detect tech and versions"

⚠️ Template generation is limited to 100 templates per day.

https://youtu.be/s7R8KAG8SeA

#bugbountytips

A small CLI tool that fetches resolved & disclosed HackerOne reports by vulnerability (CWE/keyword) and exports them to a CSV file.

python3 report_extractor.py -v "SQL Injection" -o sql_injection.csv -n 50

Features:

1. Query HackerOne via GraphQL (search by vulnerability/CWE)
2. Pagination support (fetch up to 3000 reports per run)
3. Export results to CSV (Title | Severity | URL)

https://github.com/newstartlikenoneanthor-pixel/report-extractor

#bugbountytips

Frogy 2.0 is an automated external reconnaissance and Attack Surface Management (ASM) toolkit designed to map an organization's entire internet presence. It identifies assets, IP addresses, web applications, and other metadata across the public internet, then smartly prioritizes them from an attacker's perspective.

Key Features:

1. Aggregates subdomains using multiple tools (CHAOS, Subfinder, Assetfinder, crt.sh) to map an organization's entire digital footprint.

2. Validates assets with live DNS resolution and port scanning (using DNSX and Naabu) to confirm what is publicly reachable.

3. Collects detailed HTTP response data (via HTTPX) including metadata, technology stack, status codes, content lengths, and more.

4. Uses a composite scoring system that considers homepage status, login identification, technology stack, and DNS data to generate a risk score for each asset.

5. Generates a dynamic HTML report with a modern design.

https://github.com/iamthefrogy/frogy2.0

#bugbountytips

🔥 Finding Vulnerable Hosts with LeakIX

LeakIX is a fantastic tool for quickly identifying various types of vulnerabilities.

Here are a couple of examples of how it can be used:

Exposed .git Repositories
Using the query:

+target_name +plugin:"GitConfigHttpPlugin"

This will provide a list of hosts with publicly accessible .git repositories, which often contain sensitive information.

Unauthenticated MySQL Access
Using the query:

+target_name +plugin:"MysqlOpenPlugin"

This will reveal a list of hosts where MySQL is accessible without authentication.

LeakIX offers many other interesting plugins to help uncover various vulnerabilities. You can find the full list of plugins here.

Link to the website: LeakIX

#bugbounty #bugbountytips

You can bypass this issue in Firefox by tweaking these settings:

1. Open about:config in your browser.
2️. Adjust the following:
- security.tls.version.enable-deprecated → true
- security.tls.version.min → 1

After making these changes, I was able to access the site and discovered several critical vulnerabilities on the target!

⚠️ Reminder: Always revert these settings to their original values after testing to maintain browser security.

🎯 Key Takeaway: Sometimes what looks like an inactive target is just hiding behind outdated technology. Don’t give up too soon—your next high or critical bug might be waiting!

by @aseemyash

#bugbouty #bugbountytips

💡 Bug Bounty Hunters: Don't Dismiss Targets Too Quickly!
During recon, I came across a target that threw this error:

"Secure Connection Failed – Peer using unsupported version of security protocol (SSL_ERROR_UNSUPPORTED_VERSION)"

At first, by being an beginner in game I myself assumed the target was inactive or dead. But here’s the catch: the target was active, just relying on an outdated TLS version (e.g., TLS 1.0 or TLS 1.1), which modern browsers like Firefox no longer support by default.