Random Notes on Bug Bounty Tools That Actually Work
A few tools I reach for every day in my bug bounty workflow: httpx, notify, anew, Param Miner, hakrawler, jq/cut/awk, Logger++ and GitHub recon, with the exact flags I use.
Anas Hamidi Application Security & Penetration Testing
Personal blog on offensive security: Bug Bounty, Penetration Test, write-ups, tooling notes, and curated cyber news.
- 50+ Reports
- #1 Hall of Fame
- 2+ Years
- B2 German
Latest Write-ups
Be Patient and Keep it Simple, The Bug is There
Two simple but high-impact findings, and the lessons that led me to them.
Hunting for Hidden API Endpoints Using Katana and Hakrawler
Crawling a target I thought I knew — with Katana, hakrawler, waybackurls, and unfurl — surfaced a hidden /HelpApi/ endpoint and an IDOR leaking users' PII.
