{% tabs %} {% tab title="Guides" %}
- OWASP Web Security Testing Guide - comprehensive guide to testing the security of web applications and web services created by the OWASP foundation.
- https://owasp.org/www-project-top-ten/ - Guide to the top ten most common vulnerabilities encountered in web app pentesting.
- OWASP Testing Guide 4.0 (PDF)
- https://www.crest-approved.org/membership/crest-ovs-programme/ - CREST's New application secuyrity standard built with OWASP AVS.
- Hacktricks Web Pentesting Guide - Written by Carlos Pollop, the creator of WinPEAS and LinPEAS. Everything this guy makes is gold. Highest of recommendations
- The Bug Hunters Methodology - Written by the Jason Haddix, this repo details his toolset and methodology for web app penetration testing.
- HowToHunt - Amazing collaborative project documenting testing methodology for different web application vulnerabilities.
- https://kathan19.gitbook.io/howtohunt/checklist/web-application-pentesting-checklist
- https://alike-lantern-72d.notion.site/Web-Application-Penetration-Testing-Checklist-4792d95add7d4ffd85dd50a5f50659c6
- https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf
- https://github.com/KathanP19/HowToHunt/blob/master/CheckList/mindmap.png
- https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Penetration_Testing_Methodology%402x.png
- https://github.com/jassics/security-study-plan/blob/main/web-pentest-study-plan.md {% endtab %}
{% tab title="Resources" %}
There is a bug bounty focused search engine at https://www.bugbountyhunting.com/? that can point you in the direction of tools, attacks, methodology, writeups, anything you want. It is amazing.
- bug-bounty-methodology-m **** ethodology-toolkit-tips-tricks-blogs-v-1-0
- bug-bounty-methodology-ttp-tacticstechniques-and-procedures-v-2-0
- https://pentestbook.six2dez.com/others/web-checklist
- https://pentestbook.six2dez.com/others/web-fuzzers-comparision
- https://github.com/daffainfo/AllAboutBugBounty/blob/master/Recon/Scope.md
- Operator Handbook: Web_Exploit - pg.318 {% endtab %}
{% tab title="Resource Collections" %}
- Awesome Lists Collection: Web Hacking
- Awesome Lists Collection: Web Security
- Awesome Lists Collection: Hacker API Tools
- Awesome Lists Collection: Application Security
- InfoSec Reference: Web and Web Applications.
- InfoSec Reference: Fuzzing
- Bug Bounty Forum's Tool List
- EdOverflow/bugbounty-cheatsheet
- yasinS/bug-bounty-reference
- Shiva108/Web-CTF-Cheatsheet
- Daniel Meissler's Web Security Testing Resources
- Web App Hacking Research by James Kettle - Everything that isnt posted on PortSwigger.com/research, this site is the blog for the research done by PortSwigger's Head of research, James Kettle.
- Web App Payload Collection
- https://pentestbook.six2dez.com/enumeration/webservices/ - Tools and attacks for specific web services. {% endtab %} {% endtabs %}
{% tabs %} {% tab title="Platforms" %}
- https://www.hackerone.com/
- https://www.bugcrowd.com/
- https://www.synack.com/
- https://cobalt.io/
- https://www.intigriti.com
- https://www.zerocopter.com/
- https://www.yeswehack.com/
- https://www.antihack.me/
- https://securebug.se/
- https://www.openbugbounty.org/
- https://security.apple.com/ {% endtab %}
{% tab title="Resources and Reference" %}
- Methodology
- Resource collections
- awesome-bug-bounty - is a comprehensive curated list of available Bug Bounty.
- Firebounty — Bug bounty search engine
- Write-up tools
- Bug Bounty Reconnaissance Framework (BBRF)
- Write-ups and Scopes
- Awesome-Bugbounty-Writeups - is a curated list of bugbounty writeups.
- ****bounty-targets-data - This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports
- bug-bounty-reference - is a list of bug bounty write-ups.
- Bug bounty writeups - list of bug bounty writeups (2012-2020). {% endtab %} {% endtabs %}
.png)
{% content-ref url="burp-suite.md" %} burp-suite.md {% endcontent-ref %}
{% content-ref url="web-app-testing-frameworks.md" %} web-app-testing-frameworks.md {% endcontent-ref %}
{% content-ref url="scanning-utilities.md" %} scanning-utilities.md {% endcontent-ref %}
Misc Tools
- https://www.webgap.io/ - WEBGAP remote browser isolation physically isolates you from the risks of using the internet by isolating your web browsing activity away from your local device.
- https://requestbin.com/ - A modern request bin to collect, inspect and debug HTTP requests and webhooks
- Race-the-web - Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.
- DVCS-Ripper - Rip web accessible (distributed) version control systems: SVN, GIT, Mercurial/hg, bzr, etc.
- SSLStrip - This is a new version of [Moxie´s SSLstrip] (http://www.thoughtcrime.org/software/sslstrip/) with the new feature to avoid HTTP Strict Transport Security (HSTS) protection mechanism.
- BB King's Quieter Firefox template - Stripped down Firefox with no callouts to throw off traffic. Great for testing of all sorts.
- Unfurl - Tool for breaking down a URL to better understand its components.Fake credit card numbers for testing payment systems
- Credit Cards numbers for use in testing
- interactsh - An OOB interaction gathering server and client library
- Firebounty — Bug bounty search engine
- https://github.com/brevityinmotion/goodfaith - A tool that helps you stay within scope for bug bounty recon automation.
{% content-ref url="mapping-the-site.md" %} mapping-the-site.md {% endcontent-ref %}
{% content-ref url="web-technologies/" %} web-technologies {% endcontent-ref %}
{% content-ref url="attacks-and-vulnerabilities/" %} attacks-and-vulnerabilities {% endcontent-ref %}
For resources including offensive security courses, books, CTFs and much more, please check out the Training and Resources section of this guide.
- https://tryhackme.com/module/intro-to-web-hacking
- crAPI - completely ridiculous API (crAPI) will help you to understand the ten most critical API security risks. crAPI is vulnerable by design, but you'll be able to safely run it to educate/train yourself.
{% content-ref url="../training/" %} training {% endcontent-ref %}