> For the complete documentation index, see [llms.txt](https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://s0cm0nkey.gitbook.io/s0cm0nkeys-security-reference-guide/red-offensive/web-app-hacking.md).

# Web App Hacking

Web App Hacking covers methodology, web technologies, web-specific tooling, and application vulnerabilities. Keep general host/port scanning in Red Recon, passive OSINT in Cyber Intelligence, and courses or vulnerable apps in Training.

## **Web App Testing Resources**

{% tabs %}
{% tab title="Guides" %}

* [OWASP Web Security Testing Guide](https://owasp.org/www-project-web-security-testing-guide/) - Comprehensive guide to testing the security of web applications and web services created by the OWASP foundation.
  * [OWASP Top Ten](https://owasp.org/www-project-top-ten/) - Guide to the top ten most common vulnerabilities encountered in web app pentesting.
  * [OWASP API Security Top 10](https://owasp.org/API_Security) - Focuses on the top ten vulnerabilities in API security.
  * [OWASP Cryptographic Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html) - Guidance for protecting stored secrets and sensitive data.
  * [OWASP Authorization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html) - Guidance for access control and authorization design.
  * [CREST OVS Programme](https://www.crest-approved.org/membership/crest-ovs-programme/) - CREST's new application security standard built with OWASP ASVS.
* [Hacktricks Web Pentesting Guide](https://book.hacktricks.xyz/pentesting/pentesting-web) - Written by Carlos Polop, the creator of [WinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) and [LinPEAS](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite). Highly recommended resource for creative techniques and tricks.
* [The Bug Hunters Methodology](https://github.com/jhaddix/tbhm) - Written by Jason Haddix, this repo details his toolset and methodology for web app penetration testing.
  * [Jason's Presentation of TBHM 2.0](https://docs.google.com/presentation/d/1VpRT8dFyTaFpQa9jhehtmGaC7TqQniMSYbUdlHN6VrY/edit#slide=id.p)
  * [Updated info of TBHM 4.02](https://docs.google.com/presentation/d/1MWWXXRvvesWL8V-GiwGssvg4iDM58_RMeI_SZ65VXwQ/mobilepresent?slide=id.p)
* [HowToHunt](https://kathan19.gitbook.io/howtohunt/) - Amazing collaborative project documenting testing methodology for different web application vulnerabilities.
* [HowToHunt Checklist](https://kathan19.gitbook.io/howtohunt/checklist/web-application-pentesting-checklist)
* [Adarsh's Web Application Penetration Testing Checklist](https://alike-lantern-72d.notion.site/Web-Application-Penetration-Testing-Checklist-4792d95add7d4ffd85dd50a5f50659c6)
* [Web Checklist by Chintan Gurjar (PDF)](https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf)
* [Mindmap](https://github.com/KathanP19/HowToHunt/blob/master/CheckList/mindmap.png)
* [Web Penetration Testing Methodology Diagram](https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Penetration_Testing_Methodology%402x.png)
* [Web Pentest Study Plan](https://github.com/jassics/security-study-plan/blob/main/web-pentest-study-plan.md)
  {% endtab %}

{% tab title="Resources" %}

### Resources

There is a bug bounty focused search engine at [BugBountyHunting.com](https://www.bugbountyhunting.com/) that can point you in the direction of tools, attacks, methodology, writeups, and more.

* [Bug Bounty Methodology v1.0](https://eforensicsmag.com/bug-bounty-methodology-methodology-toolkit-tips-tricks-blogs-v-1-0-by-sanyam-chawla/)
* [Bug Bounty Methodology v2.0](https://eforensicsmag.com/bug-bounty-methodology-ttp-tacticstechniques-and-procedures-v-2-0/)
* [Web Fuzzers Comparison](https://pentestbook.six2dez.com/others/web-fuzzers-comparision)
* [Bug Bounty Recon - Scope](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Recon/Scope.md)
* *Operator Handbook: Web\_Exploit - pg.318*
  {% endtab %}

{% tab title="Resource Collections" %}

* [Awesome Lists Collection: Web Hacking](https://github.com/infoslack/awesome-web-hacking)
* [Awesome Lists Collection: Web Security](https://github.com/qazbnm456/awesome-web-security)
* [Awesome Lists Collection: Hacker API Tools](https://github.com/Hacker0x01/awesome-hacker-api-tools)
* [Awesome Lists Collection: Application Security](https://github.com/paragonie/awesome-appsec)
* [SecLists](https://github.com/danielmiessler/SecLists) - The security tester's companion. It's a collection of the multiple types of lists used during security assessments, collected in one place.
* [PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings) - A list of useful payloads and bypasses for Web Application Security and Pentest/CTF.
* [InfoSec Reference: Web and Web Applications](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/Web.md)
* [InfoSec Reference: Fuzzing](https://github.com/rmusser01/Infosec_Reference/blob/master/Draft/Fuzzing.md)
* [Bug Bounty Forum's Tool List](https://bugbountyforum.com/tools/)
* [EdOverflow/bugbounty-cheatsheet](https://github.com/EdOverflow/bugbounty-cheatsheet)
* [yasinS/bug-bounty-reference](https://github.com/yasinS/bug-bounty-reference)
* [Shiva108/Web-CTF-Cheatsheet](https://github.com/Shiva108/CTF-notes/tree/master/Web-CTF-Cheatsheet)
* [Daniel Meissler's Web Security Testing Resources](https://danielmiessler.com/projects/webappsec_testing_resources/)
* [Web App Hacking Research by James Kettle](https://skeletonscribe.net/) - Everything that isn't posted on [PortSwigger.com/research](https://portswigger.net/research), this site is the blog for the research done by PortSwigger's Head of research, James Kettle.
* [Web App Payload Collection](https://github.com/foospidy/payloads)
* [Web Services Enumeration](https://pentestbook.six2dez.com/enumeration/webservices/) - Tools and attacks for specific web services.
  {% endtab %}
  {% endtabs %}

## **Bug Bounty**

{% tabs %}
{% tab title="Platforms" %}

### Platforms

* <https://www.hackerone.com/>
* <https://www.bugcrowd.com/>
  * [CISA Bug Bounty Program](https://bugcrowd.com/programs/organizations/cisa)
* <https://www.synack.com/>
* <https://cobalt.io/>
* <https://www.intigriti.com>
* <https://www.zerocopter.com/>
* <https://www.yeswehack.com/>
* <https://www.antihack.me/>
* <https://securebug.se/>
* <https://www.openbugbounty.org/>
* <https://security.apple.com/>
  {% endtab %}

{% tab title="Resources and Reference" %}

* Methodology
  * [theCyberGuy Recon V1.0](https://github.com/Cyber-Guy1/theCyberGuy_Recon_V1.0) - Bug bounty methodology mind map.
  * [Creating the perfect bug bounty automation](https://labs.detectify.com/2021/11/30/hakluke-creating-the-perfect-bug-bounty-automation/) - Detectify/Hakluke automation writeup.
* Resource collections
  * [awesome-bug-bounty](https://github.com/djadmin/awesome-bug-bounty) - is a comprehensive curated list of available Bug Bounty.
* [Firebounty](https://firebounty.com) — Bug bounty search engine
* Write-up tools
  * Bug Bounty Reconnaissance Framework (BBRF)
    * <https://github.com/honoki/bbrf-client>
    * <https://github.com/honoki/bbrf-server>
    * <https://honoki.net/2020/10/08/introducing-bbrf-yet-another-bug-bounty-reconnaissance-framework/>
* Write-ups and Scopes
  * [Awesome-Bugbounty-Writeups](https://github.com/devanshbatham/Awesome-Bugbounty-Writeups) - is a curated list of bugbounty writeups.
  * [bounty-targets-data](https://github.com/arkadiyt/bounty-targets-data) - Hourly-updated data dumps of in-scope bug bounty targets from HackerOne, Bugcrowd, Intigriti, and others.
  * [bug-bounty-reference](https://github.com/ngalongc/bug-bounty-reference) - is a list of bug bounty write-ups.
  * [Bug bounty writeups](https://pentester.land/list-of-bug-bounty-writeups.html) - Historical bug bounty writeup index from 2012-2020.
    {% endtab %}
    {% endtabs %}

![](/files/hE6LXb2yFaf5aa1l49rv)

## Web Technologies

{% content-ref url="/pages/FdKVhpZWOIAD1aX1TcWy" %}
[Web Technologies](/s0cm0nkeys-security-reference-guide/red-offensive/web-app-hacking/web-technologies.md)
{% endcontent-ref %}

## **Attacks and Vulnerabilities**

{% content-ref url="/pages/-Mkhtc5zjLRic\_ckHza0" %}
[Attacks and Vulnerabilities](/s0cm0nkeys-security-reference-guide/red-offensive/web-app-hacking/attacks-and-vulnerabilities.md)
{% endcontent-ref %}

## **Training and Resources**

Courses, books, CTFs, and vulnerable training apps are maintained in Training.

{% content-ref url="/pages/-MRPu50Q99b7LdMBbbIM" %}
[Training and Resources](/s0cm0nkeys-security-reference-guide/training.md)
{% endcontent-ref %}