NahamSec's Resources for Beginner Bug Bounty Hunters

This repository serves as a curated collection of web hacking tools, tips, and resources designed for both beginner and seasoned bug bounty hunters. It provides structured guidance across several domains including setup, tools, vulnerability types, and labs.

Key resource categories available in this repository include:

• Basics: Foundational knowledge.
• Setup: Environment configuration.
• Tools: Software and utilities for hacking.
• Labs & Testing Environments: Hands-on practice platforms.
• Vulnerability Types: Detailed information on specific security flaws.
• Mobile Hacking: Resources specific to mobile platforms.
• Coding & Scripting: Skills for automation and tool development.

For foundational knowledge in web security and bug hunting, use these industry-standard frameworks and platforms:

• OWASP Top 10: The standard awareness document for developers and security professionals.
  • TryHackMe's OWASP Top 10 Room
  • OWASP top 10 by Snyk
• OWASP Testing Guide v4: A comprehensive guide for testing web application security.
• Bug Bounty Cheat Sheets: A collection of resources by EdOverflow.
• WebSecurity Academy by PortSwigger: A highly recommended platform for learning and practicing web security vulnerabilities.

While coding is not a strict necessity for bug bounty hunting, it is a highly recommended skill for understanding web technologies and automating security tools.

For beginners, the most valuable languages to focus on are:

• Python: Useful for automating existing tools or writing entirely new ones for specific tasks.
• Bash: Essential for shell scripting and interacting with the terminal environment.

Burp Suite is a critical tool for web application security testing. Use these resources to progress from beginner to advanced usage:

• Foundations: Setting up Burp (Video Series) by Hacker101
• Introduction: Burp Suite Introduction by Jason Haddix
• Payloads: Beginners Guide to Burpsuite Payloads (Part 1) by Raj Chandel
• Advanced Techniques: Burp Hacks for Bounty Hunters by James Kettle

CSRF attacks force authenticated users to execute unwanted actions on a web application. Use these resources to learn:

Reading Material

• WebSec Academy - CSRF
• CSRF-Basics (by Princethilak)
• Cross Site Request Forgery (CSRF) by Snyk

Videos

• Cross-Site Request Forgery Attack (by PwnFunction)
• Finding Your First Bug: Cross-Site Request Forgery (by Insider PhD)
• Cross Site Request Forgery - Computerphile

Labs

• WebSec Academy - CSRF Labs

For a structured approach to bug hunting, refer to the methodology slides:

• The Bug Hunter's Methodology v.4.01 by Jason Haddix

Engage with the community and find discussions on security research via these subreddits:

• /r/BugBounty
• r/websecurityresearch/
• r/howtohack
• r/netsec
• r/netsecstudents

The following resources provide specialized cheat sheets for various security testing domains:

• Cloud Pentesting: CloudPentestCheatsheets by dafthack
• General Hacking/Pentesting: HackTricks by Carlos Polop
• HTTP/Network Requests: Everything curl by badger
• Linux/Unix Privilege Escalation: GTFObins

To study SQL Injection (SQLi) vulnerabilities, refer to:

1. GraphQL SQLi: Learn about Time-Based Blind SQL Injection in GraphQL.
2. High-impact Writeups: Review reports on enterprise database extractions (e.g., Starbucks) and cryptocurrency website hacks.
3. Techniques: Study blind SQL injection on specific platforms and how to hack database links in SQL Server.