Bug Bounty Testing, Techniques, and Tools

An ongoing & curated collection of awesome software best practices and techniques, libraries and frameworks, E-books and videos, websites, blog posts, links to github Repositories, technical guidelines and important resources about Bug Bounty in Cybersecurity.

Thanks to all contributors, you're awesome and wouldn't be possible without you! Our goal is to build a categorized community-driven collection of very well-known resources.

What is Bug Bounty?

A bug bounty program is a deal offered by many websites, organizations and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabilities.

Table of Contents

• Cross-Site Scripting (XSS)

• Brute Force

• SQL Injection (SQLi)

• External XML Entity Attack (XXE)

• Remote Code Execution (RCE)

  • Deserialization

  • Image Tragick

• Cross-Site Request Forgery (CSRF)

• Insecure Direct Object Reference (IDOR)

• Stealing Access Token

  • Google Oauth Login Bypass

• Server Side Request Forgery (SSRF)

• Unrestricted File Upload

• Race Condition

• Business Logic Flaw

• Authentication Bypass

• [HTTP Header Injection]

Cross-Site Scripting (XSS)

• Sleeping stored Google XSS Awakens a $5000 Bounty by Patrik Fehrenbach
• RPO that lead to information leakage in Google by filedescriptor
• God-like XSS, Log-in, Log-out, Log-in in Uber by Jack Whitton
• Three Stored XSS in Facebook by Nirgoldshlager
• Using a Braun Shaver to Bypass XSS Audit and WAF by Frans Rosen
• An XSS on Facebook via PNGs & Wonky Content Types by Jack Whitton

  • he is able to make stored XSS from a irrelevant domain to main facebook domain

• Stored XSS in *.ebay.com by Jack Whitton
• Complicated, Best Report of Google XSS by Ramzes
• Tricky Html Injection and Possible XSS in sms-be-vip.twitter.com by secgeek
• Command Injection in Google Console by Venkat S
• Facebook's Moves - OAuth XSS by PAULOS YIBELO
• Stored XSS in Google Docs (Bug Bounty) by Harry M Gertos
• Stored XSS on developer.uber.com via admin account compromise in Uber by James Kettle (albinowax)
• Yahoo Mail stored XSS by Klikki Oy
• Abusing XSS Filter: One ^ leads to XSS(CVE-2016-3212) by Masato Kinugawa
• Youtube XSS by fransrosen
• Best Google XSS again - by Krzysztof Kotowicz
• IE & Edge URL parsin Problem - by detectify
• Google XSS subdomain Clickjacking
• Microsoft XSS and Twitter XSS
• Google Japan Book XSS
• Flash XSS mega nz - by frans
• xss in google IE, Host Header Reflection

Brute Force

• Web Authentication Endpoint Credentials Brute-Force Vulnerability by Arne Swinnen
• InstaBrute: Two Ways to Brute-force Instagram Account Credentials by Arne Swinnen
• How I Could Compromise 4% (Locked) Instagram Accounts by Arne Swinnen
• Possibility to brute force invite codes in riders.uber.com by r0t
• Brute-Forcing invite codes in partners.uber.com by Efkan Gökbaş (mefkan)
• How I could have hacked all Facebook accounts by Anand Prakash
• Facebook Account Take Over by using SMS verification code by Arun Sureshkumar

SQL Injection

• SQL injection in Wordpress Plugin Huge IT Video Gallery in Uber by glc
• SQL Injection on sctrack.email.uber.com.cn by Orange Tsai
• Yahoo – Root Access SQL Injection – tw.yahoo.com by Brett Buerhaus
• Multiple vulnerabilities in a WordPress plugin at drive.uber.com by Abood Nour (syndr0me)

Stealing Access Token

• Facebook Access Token Stolen by Jack Whitton -
• Obtaining Login Tokens for an Outlook, Office or Azure Account by Jack Whitton
• Bypassing Digits web authentication's host validation with HPP by filedescriptor
• Bypass of redirect_uri validation with /../ in GitHub by Egor Homakov
• Bypassing callback_url validation on Digits by filedescriptor
• Stealing livechat token and using it to chat as the user - user information disclosure by Mahmoud G. (zombiehelp54)
• Change any Uber user's password through /rt/users/passwordless-signup - Account Takeover (critical) by mongo (mongo)
• Internet Explorer has a URL problem, on GitHub by filedescriptor.
• How I made LastPass give me all your passwords by labsdetectify

Google oauth bypass

• Bypassing Google Authentication on Periscope's Administration Panel By Jack Whitton

CSRF

• Messenger.com CSRF that show you the steps when you check for CSRF by Jack Whitton
• Paypal bug bounty: Updating the Paypal.me profile picture without consent (CSRF attack) by Florian Courtial
• Hacking PayPal Accounts with one click (Patched) by Yasser Ali
• Add tweet to collection CSRF by vijay kumar
• Facebookmarketingdevelopers.com: Proxies, CSRF Quandry and API Fun by phwd

Remote Code Execution

• JDWP Remote Code Execution in PayPal by Milan A Solanki
• XXE in OpenID: one bug to rule them all, or how I found a Remote Code Execution flaw affecting Facebook's servers by Reginaldo Silva
• How I Hacked Facebook, and Found Someone's Backdoor Script by Orange Tsai
• uber.com may RCE by Flask Jinja2 Template Injection by Orage Tsai
• Yahoo Bug Bounty - *.login.yahoo.com Remote Code Execution by Orange Tsai (Sorry its in Chinese Only)
• How we broke PHP, hacked Pornhub and earned $20,000 by Ruslan Habalov

  • Alert, God-like Write-up, make sure you know what is ROP before clicking, which I don't =(

• RCE deal to tricky file upload by secgeek
• WordPress SOME bug in plupload.flash.swf leading to RCE in Automatic by Cure53 (cure53)
• Read-Only user can execute arbitraty shell commands on AirOS by 93c08539 (93c08539)
• Remote Code Execution by impage upload! by Raz0r (ru_raz0r)
• Popping a shell on the Oculus developer portal by Bitquark
• Crazy! PornHub RCE AGAIN!!! How I hacked Pornhub for fun and profit - 10,000$ by 5haked
• PayPal Node.js code injection (RCE) by Michael Stepankin

Deserialization

• Java Deserialization in manager.paypal.com by Michael Stepankin
• Instagram's Million Dollar Bug by Wesley Wineberg
• (Ruby Cookie Deserialization RCE on facebooksearch.algolia.com by Michiel Prins (michiel)

Image Tragick

• Exploiting ImageMagick to get RCE on Polyvore (Yahoo Acquisition) by NaHamSec
• Exploting ImageMagick to get RCE on HackerOne by c666a323be94d57
• Trello bug bounty: Access server's files using ImageTragick by Florian Courtial

Insecure Direct Object Reference (IDOR)

• Trello bug bounty: The websocket receives data when a public company creates a team visible board by Florian Courtial
• Trello bug bounty: Payments informations are sent to the webhook when a team changes its visibility by Florian Courtial
• Change any user's password in Uber by mongo
• Vulnerability in Youtube allowed moving comments from any video to another by secgeek

  • It's Google Vulnerability, so it's worth reading, as generally it is more difficult to find Google vulnerability

• Twitter Vulnerability Could Delete Credit Cards from Any Twitter Account by secgeek
• One Vulnerability allowed deleting comments of any user in all Yahoo sites by secgeek
• Microsoft-careers.com Remote Password Reset by Yaaser Ali
• How I could change your eBay password by Yaaser Ali
• Duo Security Researchers Uncover Bypass of PayPal’s Two-Factor Authentication by Duo Labs
• Hacking Facebook.com/thanks Posting on behalf of your friends! by Anand Prakash
• How I got access to millions of [redacted] accounts
• All Vimeo Private videos disclosure via Authorization Bypass with Excellent Technical Description by Enguerran Gillier (opnsec)
• Urgent: attacker can access every data source on Bime by Jobert Abma (jobert)
• Downloading password protected / restricted videos on Vimeo by Gazza (gazza)
• Get organization info base on uuid in Uber by Severus (severus)
• How I Exposed your Primary Facebook Email Address (Bug worth $4500) by Roy Castillo
• DOB disclosed using “Facebook Graph API Reverse Engineering” by Raja Sekar Durairaj
• Change the description of a video without publish_actions permission in Facebook by phwd
• Response To Request Injection (RTRI) by ?, be honest, thanks to this article, I have found quite a few bugs because of using his method, respect to the author!
• Leak of all project names and all user names , even across applications on Harvest by Edgar Boda-Majer (eboda)
• Changing paymentProfileUuid when booking a trip allows free rides at Uber by Matthew Temmy (temmyscript)

XXE

• How we got read access on Google’s production servers by detectify
• Blind OOB XXE At UBER 26+ Domains Hacked by Raghav Bisht

Unrestricted File Upload

• File Upload XSS in image uploading of App in mopub by vijay kumar
• RCE deal to tricky file upload by secgeek
• File Upload XSS in image uploading of App in mopub in Twitter by vijay kumar (vijay_kumar1110)

Server Side Request Forgery (SSRF)

• ESEA Server-Side Request Forgery and Querying AWS Meta Data by Brett Buerhaus

Race Condition

• Race conditions on Facebook, DigitalOcean and others (fixed) by Josip Franjković
• Race Conditions in Popular reports feature in HackerOne by Fábio Pires (shmoo)

Business Logic Flaw

• Facebook simple technical hack to see the timeline by Ashish Padelkar
• How I Could Steal Money from Instagram, Google and Microsoft by Arne Swinnen
• How I could have removed all your Facebook notes
• Facebook - bypass ads account's roles vulnerability 2015 by POUYA DARABI

Authentication Bypass

• OneLogin authentication bypass on WordPress sites via XMLRPC in Uber by Jouko Pynnönen (jouko)
• 2FA PayPal Bypass by henryhoggard

HTTP Header Injection

• Twitter Overflow Trilogy in Twitter by filedescriptor
• Twitter CRLF by filedescriptor
• Adblock Plus and (a little) more in Google

Subdomain Takeover

• Hijacking tons of Instapage expired users Domains & Subdomains by geekboy
• Reading Emails in Uber Subdomains
• Slack Bug Journey - by David Vieira-Kurz

License

MIT License & cc license

This work is licensed under a Creative Commons Attribution 4.0 International License.

To the extent possible under law, Paul Veillard has waived all copyright and related or neighboring rights to this work.