> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/readme.md).

# readme

Yo everyone 👋 This repository contains complete bug hunting automation along with a full cheat sheet of commands and methodologies.

It is completely open and free to use.

Please do not repost or redistribute it anywhere without giving proper credit to the repository. Many bug hunters have worked very hard to build and contribute to this project.

Let’s respect the effort and support the community ❤️

### Recon

* [1. Passive Subdomain Enumeration](#1-passive-subdomain-enumeration)
* [2. Active Subdomain Discovery](#2-active-subdomain-discovery)
* [3. Probing & Deep Recon](#3-probing--deep-recon)
* [4. JavaScript Analysis](#4-javascript-analysis)
* [5. Google & GitHub Dorking](#5-google--github-dorking)
* [6. URL Discovery & Crawling](#6-url-discovery--crawling)
* [7. Archive & Parameter Discovery](#7-archive--parameter-discovery)
* [8. Cloud Asset Enumeration](#8-cloud-asset-enumeration)
* [9. API Enumeration](#9-api-enumeration)
* [10. Subdomain Takeover](#10-subdomain-takeover)

### Bug Hunting

* [**11. Open Redirect**](/alhamrizvi/bug-bounty-methodology/open_redirect_testing.md)
* [**12. Subdomain Takeover**](/alhamrizvi/bug-bounty-methodology/subdtakeover.md)
* [**13. Information Disclosure**](/alhamrizvi/bug-bounty-methodology/information-disclosure.md)
* [**14. Host Header Injection**](/alhamrizvi/bug-bounty-methodology/host-header-injection.md)
* [**15. Local File Inclusion**](/alhamrizvi/bug-bounty-methodology/lfi.md)
* [**16. XSS Methdology**](/alhamrizvi/bug-bounty-methodology/xss.md)
* [**17. Command Injection**](/alhamrizvi/bug-bounty-methodology/cmdi.md)
* [**18. IDOR Paremeter Finding**](/alhamrizvi/bug-bounty-methodology/idor.md)
* [**19. HTML Injection**](/alhamrizvi/bug-bounty-methodology/htmli.md)
* [**20. Wordpress Vulnerabilities**](/alhamrizvi/bug-bounty-methodology/wpvuln.md)
* [**21. SQL Injection**](/alhamrizvi/bug-bounty-methodology/sqli.md)
* [**22. Directory Traversal**](/alhamrizvi/bug-bounty-methodology/dirtrav.md)
* [**23. Header Injection**](/alhamrizvi/bug-bounty-methodology/headeri.md)
* [**24. Race Conditions**](/alhamrizvi/bug-bounty-methodology/race.md)
* [**24. XXE Injection**](/alhamrizvi/bug-bounty-methodology/xxe.md)
* [**25. SSTI Injection**](/alhamrizvi/bug-bounty-methodology/ssti.md)
* [**26. Spring Boot Actuator Exploitation**](/alhamrizvi/bug-bounty-methodology/spring.md)
* [**27. Blind XSS**](/alhamrizvi/bug-bounty-methodology/blindxss.md)
* [**28. CRLF Injection**](/alhamrizvi/bug-bounty-methodology/crlfi.md)
* [**29. Nuclei Cheatsheet**](/alhamrizvi/bug-bounty-methodology/nuclei.md)
* [**30. CORS Misconfiguration**](/alhamrizvi/bug-bounty-methodology/cors.md)
* [**31. Web Cache Poisoning**](/alhamrizvi/bug-bounty-methodology/cachepoison.md)

### 1. Passive Subdomain Enumeration

#### Subfinder

```bash
subfinder -d target.com -all -recursive -silent -o subfinder_subs.txt
```

#### Amass (Passive)

```bash
amass enum -passive -d target.com -o amass_passive_subs.txt
```

#### Assetfinder

```bash
assetfinder --subs-only target.com > assetfinder_subs.txt
```

#### Findomain

```bash
findomain -t target.com -q > findomain_subs.txt
```

#### Chaos

```bash
chaos -d target.com -silent > chaos_subs.txt
```

#### CRT.sh

```bash
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\\*\\.//g' | anew crtsh_subs.txt
```

#### GitHub Subdomains

```bash
github-subdomains -d target.com -t YOUR_GITHUB_TOKEN -o github_subs.txt
```

#### Merge Passive Results

```bash
cat *_subs.txt | sort -u | anew all_subs.txt
```

***

### 2. Active Subdomain Discovery

#### Amass (Active)

```bash
amass enum -active -d target.com -o amass_active_subs.txt
```

#### DNSX Resolve

```bash
cat bmw7.txt | dnsx -silent > bmw8.txt
```

#### Gobuster DNS

```bash
gobuster dns \
  -d dailymotion.com \
  -w /home/alham/SecLists/Discovery/DNS/subdomains-top1million-110000.txt \
  -t 50 \
  --timeout 3s \
  -o gobuster_subs.txt
```

#### PureDNS

```bash
puredns bruteforce \
  /home/alham/SecLists/Discovery/DNS/subdomains-top1million-110000.txt \
  dailymotion.com \
  --resolvers resolvers.txt \
  --write puredns_subs.txt
```

#### MassDNS

```bash
massdns \
  -r resolvers.txt \
  -t A \
  -o S \
  subdomains.txt \
  > massdns_raw.txt

Parse results:

grep " A " massdns_raw.txt | cut -d' ' -f1 | sed 's/\.$//' > massdns_subs.txt

```

#### ShuffleDNS

```bash
shuffledns -d target.com -w dns_wordlist.txt -r resolvers.txt -silent > shuffledns_subs.txt
```

#### Merge Active Results

```bash
cat *_active_subs.txt | sort -u > active_final.txt
```

***

### 3. Probing & Deep Recon

#### HTTPX

```bash
httpx -l resolved_subs.txt -p 80,443,8080,8443 -silent -title -sc -ip -o live_websites.txt
```

#### Httprobe

```bash
cat resolved_subs.txt | httprobe > live_websites.txt
```

#### Endpoint Filtering

```bash
cat live_websites.txt | grep -Ei "login|admin|signin|dashboard" | tee login_endpoints.txt
```

***

### 4. JavaScript Analysis

#### JavaScript Collection

```bash
cat live_websites.txt | gau --subs | grep -i "\\.js$" | sort -u > js_passive.txt
katana -list live_websites.txt -jc -silent | grep -i "\\.js$" | sort -u > js_active.txt
sort -u js_active.txt > katanajs_clean.txt
cat js_passive.txt katanajs_clean.txt | sort -u > js_all.txt
```

#### Mantra

```bash
cat js_all.txt | mantra
```

#### LinkFinder

```bash
python3 linkfinder.py -i js_files.txt -o js_endpoints.txt
```

#### JSFinder

```bash
python3 JSFinder.py -u https://target.com -o jsfinder_results.txt
```

#### SecretFinder

```bash
python3 SecretFinder.py -i js_files.txt -o secrets.txt
```

#### GF Patterns

```bash
cat js_files.txt | gf aws-keys | tee aws_keys.txt
cat js_files.txt | gf api-keys | tee api_keys.txt
cat js_files.txt | gf urls | tee sensitive_urls.txt
```

***

### 5. Google & GitHub Dorking

#### GitDorker

```bash
python3 GitDorker.py -tf github_token.txt -q target.com -d dorks.txt -o git_dorks_output.txt
```

#### GitHound

```bash
githound --config config.yml --subdomain-file live_websites.txt
```

***

### 6. URL Discovery & Crawling

#### Katana

```bash
katana -list live_websites.txt -jc -o katana_urls.txt
```

#### Gospider

```bash
gospider -S live_websites.txt -d 2 -o gospider_output/
```

#### Hakrawler

```bash
cat live_websites.txt | hakrawler -d 3 -subs -u > hakrawler_results.txt

or

cat dailylive.txt | hakrawler > hakrawler.txt

```

#### Feroxbuster

```bash
feroxbuster -u https://target.com -d 2 -q -o ferox_urls.txt
```

#### Get Alive host

```bash
cat finalurls.txt \
| awk -F/ '{print $1"//"$3}' \
| sort -u \
| ~/go/bin/httpx -silent -mc 200,301,302,403 \
> alive_hosts.txt

```

***

### 7. Archive & Parameter Discovery

#### GAU & Wayback

```bash
gau --subs target.com | anew archived_urls.txt
waybackurls target.com | anew wayback_urls.txt
```

#### Merge Archives

```bash
cat archived_urls.txt wayback_urls.txt | sort -u > all_archived_urls.txt
```

#### Parameter Extraction

```bash
cat all_archived_urls.txt | grep "=" | anew parameters.txt
```

#### ParamSpider

```bash
python3 paramspider.py --domain target.com --exclude woff,css,png,jpg --output paramspider.txt
```

#### Arjun

```bash
arjun -u https://target.com -oT arjun_params.txt
```

#### FFUF

```bash
ffuf -u "https://target.com/page.php?FUZZ=test" -w /usr/share/wordlists/params.txt -o parameter_results.txt
```

***

### 8. Cloud Asset Enumeration

```bash
cloud_enum -k target.com -b buckets.txt -o cloud_enum_results.txt
aws s3 ls s3://bucket-name --no-sign-request
python3 AWSBucketDump.py -b target-bucket -o dumped_data/
s3scanner scan --bucket target-bucket
```

***

### 9. API Enumeration

```bash
kr scan https://api.target.com -w /usr/share/kiterunner/routes-large.kite -o api_routes.txt

or
grep -Ei '(^|\.)(api|graphql|rest|v[0-9])(\.|$)' urls.txt \
| sort -u \
> api_enndpoints.txt


```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/readme.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.