- OWASP Web Security Testing Guide - comprehensive guide to testing the security of web applications and web services created by the OWASP foundation.
- https://owasp.org/www-project-top-ten/ - Guide to the top ten most common vulnerabilities encountered in web app pentesting.
- OWASP Testing Guide 4.0 (PDF)
- Hacktricks Web Pentesting Guide - Written by Carlos Pollop, the creator of WinPEAS and LinPEAS. Everything this guy makes is gold. Highest of recommendations
- The Bug Hunters Methodology - Written by the Jason Haddix, this repo details his toolset and methodology for web app penetration testing.
- HowToHunt - Amazing collaborative project documenting testing methodology for different web application vulnerabilities.
- https://kathan19.gitbook.io/howtohunt/checklist/web-application-pentesting-checklist
- https://alike-lantern-72d.notion.site/Web-Application-Penetration-Testing-Checklist-4792d95add7d4ffd85dd50a5f50659c6
- https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf
- https://github.com/KathanP19/HowToHunt/blob/master/CheckList/mindmap.png
- https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Penetration_Testing_Methodology%402x.png
There is a bug bounty focused search engine at https://www.bugbountyhunting.com/? that can point you in the direction of tools, attacks, methodology, writeups, anything you want. It is amazing.
- bug-bounty-methodology-m **** ethodology-toolkit-tips-tricks-blogs-v-1-0
- bug-bounty-methodology-ttp-tacticstechniques-and-procedures-v-2-0
- https://pentestbook.six2dez.com/others/web-checklist
- https://pentestbook.six2dez.com/others/web-fuzzers-comparision
- https://github.com/daffainfo/AllAboutBugBounty/blob/master/Recon/Scope.md
- Operator Handbook: Web_Exploit - pg.318
- Awesome Lists Collection: Web Hacking
- Awesome Lists Collection: Web Security
- Awesome Lists Collection: Hacker API Tools
- Awesome Lists Collection: Application Security
- InfoSec Reference: Web and Web Applications.
- InfoSec Reference: Fuzzing
- Bug Bounty Forum's Tool List
- EdOverflow/bugbounty-cheatsheet
- yasinS/bug-bounty-reference
- Shiva108/Web-CTF-Cheatsheet
- Daniel Meissler's Web Security Testing Resources
- Web App Hacking Research by James Kettle - Everything that isnt posted on PortSwigger.com/research, this site is the blog for the research done by PortSwigger's Head of research, James Kettle.
- Web App Payload Collection
- https://pentestbook.six2dez.com/enumeration/webservices/ - Tools and attacks for specific web services.
- https://www.hackerone.com/
- https://www.bugcrowd.com/
- https://www.synack.com/
- https://cobalt.io/
- https://www.intigriti.com
- https://www.zerocopter.com/
- https://www.yeswehack.com/
- https://www.antihack.me/
- https://securebug.se/
- https://www.openbugbounty.org/
-
Methodology
-
Resource collections
- awesome-bug-bounty - is a comprehensive curated list of available Bug Bounty.
-
Firebounty — Bug bounty search engine
-
Write-up tools
- Bug Bounty Reconnaissance Framework (BBRF)
-
Write-ups and Scopes
- Awesome-Bugbounty-Writeups - is a curated list of bugbounty writeups.
- ****bounty-targets-data - This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports
- bug-bounty-reference - is a list of bug bounty write-ups.
- Bug bounty writeups - list of bug bounty writeups (2012-2020).
.png)
{% content-ref url="burp-suite.md" %} burp-suite.md {% endcontent-ref %}
{% content-ref url="web-app-testing-frameworks.md" %} web-app-testing-frameworks.md {% endcontent-ref %}
{% content-ref url="scanning-utilities.md" %} scanning-utilities.md {% endcontent-ref %}
{% content-ref url="mapping-the-site.md" %} mapping-the-site.md {% endcontent-ref %}
{% content-ref url="web-technologies/" %} web-technologies {% endcontent-ref %}
{% content-ref url="attacks-and-vulnerabilities/" %} attacks-and-vulnerabilities {% endcontent-ref %}
- https://www.webgap.io/ - WEBGAP remote browser isolation physically isolates you from the risks of using the internet by isolating your web browsing activity away from your local device.
- https://requestbin.com/ - A modern request bin to collect, inspect and debug HTTP requests and webhooks
- Race-the-web - Tests for race conditions in web applications. Includes a RESTful API to integrate into a continuous integration pipeline.
- DVCS-Ripper - Rip web accessible (distributed) version control systems: SVN, GIT, Mercurial/hg, bzr, etc.
- SSLStrip - This is a new version of [Moxie´s SSLstrip] (http://www.thoughtcrime.org/software/sslstrip/) with the new feature to avoid HTTP Strict Transport Security (HSTS) protection mechanism.
- BB King's Quieter Firefox template - Stripped down Firefox with no callouts to throw off traffic. Great for testing of all sorts.
- Unfurl - Tool for breaking down a URL to better understand its components.Fake credit card numbers for testing payment systems
- Credit Cards numbers for use in testing
- interactsh - An OOB interaction gathering server and client library
- Firebounty — Bug bounty search engine
For resources including offensive security courses, books, CTFs and much more, please check out the Training and Resources section of this guide.
{% content-ref url="../training/" %} training {% endcontent-ref %}