Random Notes on Bug Bounty Tools That Actually Work
A few tools I reach for every day in my bug bounty workflow: httpx, notify, anew, Param Miner, hakrawler, jq/cut/awk, Logger++ and GitHub recon, with the exact flags I use.
POSTS
8
posts
Be Patient and Keep it Simple, The Bug is There
Two simple but high-impact findings, and the lessons that led me to them.
Hunting for Hidden API Endpoints Using Katana and Hakrawler
Crawling a target I thought I knew — with Katana, hakrawler, waybackurls, and unfurl — surfaced a hidden /HelpApi/ endpoint and an IDOR leaking users' PII.
How easy I made $$$$
A reality check on bug bounty and the myth of easy money.
Don't Trust the Cache: Exposing Web Cache Poisoning and Deception Vulnerabilities
A field guide to web cache attacks — from CP-DoS tricks (oversize headers, meta characters, method override, unkeyed ports, redirect DoS) to poisoning with XSS payloads and web cache deception via path confusion.
Click, Intercept, Hack: Checkmate on Access Control Vulnerability
A Broken Access Control bug on a chess platform, via request interception and cookie swapping.
Bugs & JS: A Closer Look at JavaScript for Successful Bug Hunting
Why JavaScript files are a goldmine for bug hunters — the tools (JSleak, JSecret, jsluice), the workflow, and the resources I use to dig secrets, endpoints, and client-side bugs out of JS.
How One Bug Scored Me Double Rewards!
A forgotten subdomain, a Shodan dork, and a single PUT request — how one overlooked endpoint led to an information disclosure and then an IDOR into users' video session data.