Skip to content

Bug Hunting Methodology


Passive recon

  • Using Shodan to detect similar app
can be integrated with nmap (
nmap --script shodan-hq.nse --script-args 'apikey=<yourShodanAPIKey>,target=<hackme>'
look for JS files, old links
curl -sX GET "<>&output=text&fl=original&collapse=urlkey&matchType=prefix"
python -b all -d
  • Look for private information in GitHub repos with GitRob

    gitrob analyze johndoe --site= --endpoint= --access-tokens=token1,token2

  • Perform Google Dorks search

Active recon

Network discovery

Web discovery

Looking for Web vulnerabilities

  • Explore the website and look for vulnerabilities listed in this repository: SQL injection, XSS, CRLF, Cookies, ....
  • Test for Business Logic weaknesses
  • High or negative numerical values
  • Try all the features and click all the buttons
  • The Web Application Hacker's Handbook Checklist copied from

  • Subscribe to the site and pay for the additional functionality to test

  • Inspect Payment functionality - @gwendallecoguic

    if the webapp you're testing uses an external payment gateway, check the doc to find the test credit numbers, purchase something and if the webapp didn't disable the test mode, it will be free

From : "Use any of the following test card numbers, a valid expiration date in the future, and any random CVC number, to create a successful payment. Each test card's billing country is set to U.S. " e.g :

Test card numbers and tokens

4242424242424242 Visa tok_visa
4000056655665556 Visa (debit) tok_visa_debit
5555555555554444 Mastercard tok_mastercard

International test card numbers and tokens

4000000400000008 tok_at Austria (AT) Visa
4000000560000004 tok_be Belgium (BE) Visa
4000002080000001 tok_dk Denmark (DK) Visa
4000002460000001 tok_fi Finland (FI) Visa
4000002500000003 tok_fr France (FR) Visa