awesome-bug-bounty
A comprehensive curated list of available Bug Bounty & Disclosure Programs and Write-ups.
Top Related Projects
A list of resources for those interested in getting started in bug bounties
A list of interesting payloads, tips and tricks for bug bounty hunters.
Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature
A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference
Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters..
A collection of various awesome lists for hackers, pentesters and security researchers
Quick Overview
The "awesome-bug-bounty" repository is a curated list of bug bounty programs and resources for security researchers and ethical hackers. It provides a comprehensive collection of platforms, tools, and educational materials related to bug bounty hunting and vulnerability disclosure.
Pros
- Extensive collection of bug bounty programs and platforms
- Regularly updated with new resources and information
- Well-organized and categorized for easy navigation
- Includes educational materials and learning resources for beginners
Cons
- May be overwhelming for newcomers due to the large amount of information
- Some listed resources or programs may become outdated over time
- Lacks detailed explanations or reviews of individual resources
- Does not provide step-by-step guides for participating in bug bounty programs
Note: As this is not a code library, the code examples and getting started instructions sections have been omitted.
Competitor Comparisons
A list of resources for those interested in getting started in bug bounties
Pros of Resources-for-Beginner-Bug-Bounty-Hunters
- More beginner-friendly with structured learning paths
- Includes practice labs and CTF resources
- Offers a curated list of YouTube channels and streamers
Cons of Resources-for-Beginner-Bug-Bounty-Hunters
- Less comprehensive in terms of tools and platforms
- Fewer links to specific vulnerability types and techniques
- Not as frequently updated as awesome-bug-bounty
Code Comparison
While both repositories primarily consist of markdown files with lists of resources, Resources-for-Beginner-Bug-Bounty-Hunters includes some basic HTML for better organization:
Resources-for-Beginner-Bug-Bounty-Hunters:
<details>
<summary>Mobile Hacking</summary>
- [Android App Reverse Engineering 101](https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/)
- [iOS Application Security Review Methodology](http://www.sans.org/reading-room/whitepapers/testing/ios-application-security-review-methodology-34577)
</details>
awesome-bug-bounty:
## Mobile Hacking
* [Android App Reverse Engineering 101](https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/)
* [iOS Application Security Review Methodology](http://www.sans.org/reading-room/whitepapers/testing/ios-application-security-review-methodology-34577)
Both repositories serve as valuable resources for bug bounty hunters, with awesome-bug-bounty offering a more comprehensive list of tools and platforms, while Resources-for-Beginner-Bug-Bounty-Hunters provides a more structured approach for newcomers to the field.
A list of interesting payloads, tips and tricks for bug bounty hunters.
Pros of bugbounty-cheatsheet
- More focused and concise content, specifically tailored for bug bounty hunters
- Includes practical cheat sheets and payloads for various vulnerability types
- Regularly updated with community contributions
Cons of bugbounty-cheatsheet
- Less comprehensive in terms of overall resources and tools
- Lacks categorization of platforms, programs, and write-ups found in awesome-bug-bounty
- May be more challenging for beginners due to its technical nature
Code Comparison
bugbounty-cheatsheet:
## Cross-Site Scripting (XSS)
```javascript
<script>alert('XSS')</script>
<scr<script>ipt>alert('XSS')</scr<script>ipt>
"><script>alert('XSS')</script>
awesome-bug-bounty:
## Platforms
- [HackerOne](https://hackerone.com/)
- [Bugcrowd](https://www.bugcrowd.com/)
- [Intigriti](https://www.intigriti.com/)
The code comparison shows that bugbounty-cheatsheet focuses on providing specific payloads and examples, while awesome-bug-bounty offers a more comprehensive list of resources and platforms. Both repositories serve different purposes within the bug bounty ecosystem, with bugbounty-cheatsheet being more hands-on and awesome-bug-bounty offering a broader overview of the field.
Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature
Pros of bug-bounty-reference
- More detailed and categorized information on specific vulnerabilities
- Includes write-ups and case studies for real-world examples
- Provides a comprehensive list of tools for bug bounty hunting
Cons of bug-bounty-reference
- Less frequently updated compared to awesome-bug-bounty
- Focuses more on technical details, which may be overwhelming for beginners
- Lacks some broader resources like bug bounty platforms and general guides
Code comparison
While both repositories are primarily curated lists of resources, they don't contain significant code. However, here's a comparison of their README structures:
awesome-bug-bounty:
# awesome-bug-bounty
A comprehensive curated list of Bug Bounty Programs and write-ups.
## Table of Contents
- [Bug Bounty Platforms](#bug-bounty-platforms)
- [List of Programs](#list-of-programs)
bug-bounty-reference:
# Bug Bounty Reference
A list of bug bounty write-up that is categorized by the bug nature, this is inspired by https://github.com/djadmin/awesome-bug-bounty
## Introduction
Both repositories use similar Markdown structures, but bug-bounty-reference focuses more on categorizing vulnerabilities, while awesome-bug-bounty provides a broader overview of bug bounty resources.
A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference
Pros of Awesome-Bugbounty-Writeups
- Focuses specifically on detailed bug bounty writeups, providing in-depth case studies
- Organized by vulnerability types, making it easier to find relevant examples
- Includes a section on mobile app security, which is not present in awesome-bug-bounty
Cons of Awesome-Bugbounty-Writeups
- Less comprehensive in terms of general bug bounty resources and tools
- Fewer categories and subcategories compared to awesome-bug-bounty
- May not be updated as frequently as awesome-bug-bounty
Code Comparison
While both repositories are primarily curated lists of resources, they don't contain significant code. However, the structure of their README files differs:
Awesome-Bugbounty-Writeups:
## SQL Injection
- [SQL Injection on API Parameter](link)
- [Blind SQL Injection on Forgot Password Function](link)
awesome-bug-bounty:
### Tools
* [SubFinder](https://github.com/subfinder/subfinder) - SubFinder is a subdomain discovery tool that discovers valid subdomains for websites.
* [Amass](https://github.com/OWASP/Amass) - In-depth Attack Surface Mapping and Asset Discovery
The main difference is that Awesome-Bugbounty-Writeups focuses on categorizing writeups, while awesome-bug-bounty organizes various resources including tools, platforms, and learning materials.
Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters..
Pros of KingOfBugBountyTips
- More focused on practical tips and techniques for bug bounty hunting
- Includes specific tools and commands for various vulnerability types
- Regularly updated with new content and resources
Cons of KingOfBugBountyTips
- Less structured organization compared to awesome-bug-bounty
- May be overwhelming for beginners due to the abundance of technical information
- Lacks comprehensive categorization of resources
Code Comparison
KingOfBugBountyTips often includes specific command examples:
subfinder -d target.com -silent | httpx -silent | nuclei -t nuclei-templates -o result.txt
awesome-bug-bounty typically provides links to resources rather than code snippets:
- [The Bug Hunters Methodology](https://github.com/jhaddix/tbhm) - A community-driven guide to finding bugs
Summary
KingOfBugBountyTips is a more hands-on resource with practical tips and tools for active bug bounty hunters. It offers specific commands and techniques but may be less organized. awesome-bug-bounty provides a well-structured collection of resources, making it more suitable for beginners and as a reference guide. The choice between the two depends on the user's experience level and specific needs in bug bounty hunting.
A collection of various awesome lists for hackers, pentesters and security researchers
Pros of Awesome-Hacking
- Broader scope covering various hacking topics beyond bug bounties
- More extensive list of resources and tools
- Regularly updated with new content and contributions
Cons of Awesome-Hacking
- Less focused on bug bounty programs specifically
- May be overwhelming for beginners due to the vast amount of information
- Some links may be outdated or less relevant for bug bounty hunters
Code Comparison
While both repositories are primarily curated lists of resources, they don't contain significant code samples. However, here's a comparison of their README structures:
Awesome-Bug-Bounty:
# awesome-bug-bounty
A comprehensive curated list of Bug Bounty Programs and write-ups.
## Table of Contents
- [Bug Bounty Platforms](#bug-bounty-platforms)
- [Bug Bounty Write-ups](#bug-bounty-write-ups)
Awesome-Hacking:
# Awesome-Hacking
A collection of awesome lists for hackers, pentesters & security researchers.
## Table of Contents
- [System](#system)
- [Reverse Engineering](#reverse-engineering)
- [Web](#web)
Both repositories use similar Markdown structures, but Awesome-Hacking covers a wider range of topics in its table of contents.
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual CopilotREADME
Awesome Bug Bounty
A comprehensive curated list of Bug Bounty Programs and write-ups from the Bug Bounty hunters.
Table of Contents
Getting Started
- How to Become a Successful Bug Bounty Hunter
- Researcher Resources - How to become a Bug Bounty Hunter
- Bug Bounties 101
- The life of a bug bounty hunter
- Awsome list of bugbounty cheatsheets
- Getting Started - Bug Bounty Hunter Methodology
Write Ups & Authors
- sakurity.com/blog - by Egor Homakov
- respectxss.blogspot.in - by Ashar Javed
- labs.detectify.com - by Frans Rosén
- cliffordtrigo.info - by Clifford Trigo
- stephensclafani.com - by Stephen Sclafani
- sasi2103.blogspot.co.il - by Sasi Levi
- pwnsecurity.net - by Shashank
- breaksec.com - by Nir Goldshlager
- pwndizzle.blogspot.in - by Alex Davies
- c0rni3sm.blogspot.in - by yappare
- exploit.co.il/blog - by Shai rod
- ibreak.software - by Riyaz Ahemed Walikar
- panchocosil.blogspot.in - by Francisco Correa
- breakingmesh.blogspot.in - by Sahil Sehgal
- websecresearch.com - by Ajay Singh Negi
- securitylearn.net - by Satish Bommisetty
- secinfinity.net - by Prakash Sharma
- websecuritylog.com - by jitendra jaiswal
- medium.com/@ajdumanhug - by Allan Jay Dumanhug
- Web Hacking 101 - by Peter Yaworski
Platforms
- YesWeHack
- intigriti
- HackerOne
- Bugcrowd
- Cobalt
- Bountysource
- Bounty Factory
- Coder Bounty
- FreedomSponsors
- FOSS Factory
- Synack
- HackenProof
- Detectify
- Bugbountyjp
- Safehats
- BugbountyHQ
- Hackerhive
- Hacktrophy
- AntiHACK
- CESPPA
Available Programs
- 123Contact Form
- 99designs
- Abacus
- Acquia
- ActiveCampaign
- ActiveProspect
- Adobe
- AeroFS
- Airbitz
- Airbnb
- Algolia
- Altervista
- Altroconsumo
- Amara
- Amazon Web Services
- Amazon.com
- ANCILE Solutions Inc.
- Anghami
- ANXBTC
- Apache httpd
- Appcelerator
- Apple
- Apptentive
- Aptible
- Ardour
- Arkane
- ARM mbed
- Asana
- ASP4all
- AT&T
- Atlassian
- Attack-Secure
- Authy
- Automattic
- Avast!
- Avira
- AwardWallet
- Badoo
- Barracuda
- Base
- Basecamp
- Beanstalk
- BillGuard
- Billys Billing
- Binary.com
- Binary.com Cashier
- BitBandit.eu
- Bitcasa
- BitCasino
- BitGo
- BitHealth
- BitHunt
- BitMEX
- Bitoasis
- Bitpagos
- Bitrated
- Bitreserve
- Bitspark
- Bitwage
- BitWall
- BitYes
- BlackBerry
- Blackboard
- Blackphone
- Blesta
- Block.io
- Block.io, Inc.
- Blockchain.info
- BlockScore
- Bookfresh
- Box
- Braintree
- Brussels Airlines
- BTC_sx
- Buffer
- BX.in.th
- C2FO
- Campaign Monitor
- CARD.com
- Catchafire
- Caviar
- CCBill
- CERT/CC
- Certly
- ChainPay
- ChangeTip
- Chargify
- Chromium Project
- Circle
- CircleCI
- Cisco
- ClickUp
- Clojars
- CloudFlare
- Cobalt
- Code Climate
- CodeIgniter
- CodePen
- Coin Republic
- Coin.Space
- Coinage
- Coinbase
- CoinDaddy
- Coinkite
- Coinport
- coins.ph
- Cointrader.net
- Coinvoy
- Collishop
- Colruyt
- Compose
- concrete5
- Constant Contact
- Counterparty
- Coupa
- Coursera
- cPanel
- cPaperless
- Crix.io
- Cross Border Fines
- CrowdShield
- Cryptocat
- Cupcake
- CustomerInsight
- Cylance
- Dato Capital
- Detectify
- De Volkskrant
- Delen Private Bank
- DigitalOcean
- DigitalSellz
- Django
- Doorkeeper
- DoSomething
- DPD
- Dragon King
- Dreambaby
- Dreamland
- Dropbox
- Dropbox Acquisitions
- Drupal
- eBay
- Eclipse
- eHealth Hub VZN KUL
- EMC
- Enano
- Engine Yard
- Envoy
- Eobot
- EthnoHub
- Etsy
- EVE
- Event Espresso
- Everitoken
- Evernote
- EURid
- Expatistan
- ExpressionEngine
- Ezbob
- Faceless
- Factlink
- FanFootage
- FastSlots
- Flash
- Flood
- Flow Dock
- Flox
- Fluxiom
- Fog Creek
- FormAssembly
- Founder Bliss
- Foursquare
- Freelancer
- Gallery
- Gamma
- Gemfury
- General Motors
- GhostMail
- GitHub
- GitLab
- GlassWire
- Gliph
- GlobaLeaks
- Google PRP
- Google VRP
- Grammarly
- Gratipay
- GreenAddress
- Greenhouse.io
- Grok Learning
- HackenProof
- HackerOne
- Harmony
- Heroku
- Hex-Rays
- Hive Wallet
- Hootsuite
- HTC
- Huawei
- Hubdia
- Humble Bundle
- IAM KU Leuven
- Ian Dunn
- IBM
- ICEcoder
- Iconfinder
- Ifixit
- Imgur
- ImpressPages
- Indeed
- Independent Reserve
- Informatica
- IntegraXor
- Internetwache
- InVision
- IRCCloud
- itBit Exchange
- ITRP
- itsme
- joola.io
- Joomla
- JRuby
- jsDelivr
- Juniper
- Kadira
- Kaneva
- Kayako
- Kenna
- Keybase
- Khan Academy
- SKB Kontur
- Kraken
- Kinepolis
- Kuna
- Lancor Income
- LastPass
- LaunchKey
- Lean Testing
- Librato
- LibSass
- Liferay
- Line
- LiveEnsure
- LocalBitcoins
- Localize
- Logentries
- Lookout
- Magento
- MAGIX
- Mahara
- MaiCoin
- Mail.Ru
- Mailbird
- MailChimp
- ManageBGL
- ManageWP
- MapLogin
- Marietje Schaake
- Marktplatts
- Mavenlink
- Maximum
- MCProHosting
- MEGA
- Mercury
- Meteor
- meXBT
- Microsoft
- Mimecast
- Mobile Vikings
- Mobile Vikings
- Modus CSR
- MoneyBird
- MoneyStream
- Moodle
- Motorola Solutions
- Mozilla
- mynxt.info
- NCSC
- Nearby Live
- Nest
- Netflix
- Neverdie Smart Contract
- Neverdie Web
- Nexmo
- Nexuzhealth
- Nexuzhealth Web PACS
- Nginx
- Nitrous
- Nokia Networks
- NoPass
- NZRS
- Offensive Security
- ok.ru
- OKCoin
- OkCupid
- Olark
- OneSpan Mobile
- OneSpan Server Products
- Opal Cryptocurrency
- Openfolio
- OpenSSL
- OpenStack
- OpenText
- Opera
- Optimizely
- Oracle
- ownCloud
- PagerDuty
- Panasonic Avionics
- Pantheon
- Panzura
- Paragon Initiative Enterprises
- Paychoice
- PayMill
- PayPal
- Paytm
- Perl
- Phabricator
- PHP
- Pidgin
- PikaPay
- PinoyHackNews
- Piwik Open Source Analytics
- Plone
- Poloniex
- Postmark
- Prezi
- Projectplace
- PullReview
- Puppet labs
- PureVPN
- Python
- QIWI
- Quadriga CX
- QuickBT
- Quora
- Rackspace
- Rdbhost_service
- Red Hat
- Relaso
- RelateIQ
- Release Wire
- Respondly
- Revive Adserver
- Ribose
- Ripio
- Ripple
- Riskalyze
- Romit
- Ruby
- Ruby on Rails
- Salesforce
- Samsung TV
- Sandbox Escape
- SAP
- Schuberg Philis
- Scorpion Software
- Secret
- Secure Works
- Sellfy
- Sentiance
- ServiceRocket
- ShareLaTeX
- Sherpany
- Shopify
- Sifter
- Silent Circle
- Simple
- SiteGround
- Skoodat
- Skrill
- Skyscanner
- Slack
- Snapchat
- Snappy
- Sonatype
- Sony
- SoundCloud
- Spaargids
- SpectroCoin
- Spendbitcoins
- SplashID
- Splitwise
- Spotify
- Sprout Social
- Square
- Square Open Source
- StatusPage
- StopTheHacker
- Student Assessment System
- Studio 100
- Subledger
- Subrosa
- Sucuri
- Suivo
- Symantec
- Taptalk
- Tarsnap
- TeamUnify
- Tele2
- Telekom
- Telenet
- Test-Aankoop
- The Internet
- The Mastercoin Foundation
- ThisData
- TimeTrex
- ToyTalk
- Trello
- Tuenti
- Tweakers
- Twilio
- Twitch
- Uber
- Ubiquiti Networks
- Unitag
- Urban Dictionary
- Uzbey
- Valve Software
- VeChainThor
- VeChainThor Wallet
- VCE
- Venmo
- Version Cake
- Viadeo
- Vimeo
- VK.com
- Volusion
- VPNSox
- vulners.com
- Vultr
- Webconverger
- Websecurify
- Weebly
- WePay
- Whisper
- WHMCS
- Windthorst ISD
- withinsecurity
- WizeHive
- Woorank
- WordPoints
- Wordware
- WP API
- Xen Project
- Xmarks
- Yahoo
- Yandex
- Yanomo
- Yesware
- Zapier
- Zaption
- ZenCash
- Zendesk
- Zetetic
- Ziggo
- Zimbra
- Zoho
- Zomato
- Zopim
- Zynga
Aggregators
License
To the extent possible under law, Dheeraj Joshi has waived all copyright and related or neighboring rights to this work.
Top Related Projects
A list of resources for those interested in getting started in bug bounties
A list of interesting payloads, tips and tricks for bug bounty hunters.
Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature
A curated list of bugbounty writeups (Bug type wise) , inspired from https://github.com/ngalongc/bug-bounty-reference
Our main goal is to share tips from some well-known bughunters. Using recon methodology, we are able to find subdomains, apis, and tokens that are already exploitable, so we can report them. We wish to influence Onelinetips and explain the commands, for the better understanding of new hunters..
A collection of various awesome lists for hackers, pentesters and security researchers
Convert designs to code with AI
Introducing Visual Copilot: A new AI model to turn Figma designs to high quality code using your components.
Try Visual Copilot