Bug Bounty Roadmap - Learn Bug Bounty from Zero to Hunter
A complete, interactive Bug Bounty Roadmap: a step-by-step learning path that takes you from networking and Linux fundamentals through web hacking, cloud security, recon and automation, active hunting, and on to exploit development and vulnerability research. Every stage below links the essential topics, books, practice platforms, tools, and write-ups you need. Explore it as an interactive graph above, or read the full roadmap as text below.
The Bug Bounty Learning Path - 9 Stages
Stage 1: Network & Linux
The absolute foundation. Master TCP/IP, the Linux terminal, and how packets travel before you ever touch an exploit. Every bug bounty hunter needs this bedrock.
Network & Linux - Key Topics
- TCP/IP & OSI - 7 OSI layers and the 4-layer TCP/IP stack. Knowing where attacks happen on the network stack is foundational - from ARP poisoning to TCP session hijacking.
- App Protocols - HTTP, DNS, FTP, SSH, SMTP, WebSockets. Understanding protocol behavior is the first step to breaking it.
- Linux CLI - Filesystem, permissions, processes, piping, grep, sed, awk, cron. Most hacking tools run on Linux - be completely fluent before anything else.
- Kali / Setup - Setting up your Kali Linux hacking environment. Tools, VPN, proxychains, Burp CA cert, and workflow before hitting live targets.
Network & Linux - Recommended Books
- Computer Networks by Andrew S. Tanenbaum - The definitive textbook on networks from physical layer to application layer. Read chapters 1-5 thoroughly - every network attack makes more sense after this book.
- How Linux Works by Brian Ward - Deep dive into Linux internals: processes, memory management, filesystem hierarchy, and networking. Essential reading for any serious security professional.
- Linux Basics for Hackers by OccupyTheWeb - From the ground up - Kali Linux setup, bash scripting, networking, and staying anonymous. Practical and fun, designed specifically for aspiring hackers.
- The Linux Command Line by William Shotts - Comprehensive guide to the Linux shell, scripting, and command-line tools. Command-line mastery here directly translates to faster, more effective security work.
- Practical Packet Analysis by Chris Sanders - Learn Wireshark and packet capture deeply. Understanding raw network traffic is critical for spotting anomalies, debugging tool output, and network-layer attacks.
- Wicked Cool Shell Scripts by Dave Taylor - 101 practical shell scripts for automation and creative problem solving. Elevates your shell scripting from basic to genuinely useful for security work.
Stage 2: Web Fundamentals
HTTP is the language of every web target. Learn every header, method, auth protocol, and cookie mechanism deeply - most critical web bugs live in these fundamentals.
Web Fundamentals - Key Topics
- How Web Works - DNS → TCP → TLS → HTTP → response cycle. Knowing each step in detail helps you identify exactly where to inject or intercept.
- HTTP & HTTPS - Methods, headers, status codes, keep-alive, HTTP/2, HTTP/3, compression, encoding. The grammar of web hacking.
- OAuth2 / SSO - Authorization code flow, PKCE, state parameter, open redirects in redirect_uri. OAuth misconfigs are consistently high-severity findings.
- WAF & CDN - How WAFs detect and block attacks, CDN caching mechanics, cache poisoning, and bypass techniques using encoding or HTTP quirks.
- Cookies & Sessions - SameSite, HttpOnly, Secure, domain/path scoping, session fixation, cookie tossing. Cookie mechanics unlock CSRF and session attacks.
- Security Headers - CSP, HSTS, X-Frame-Options, CORS headers, Referrer-Policy. Misconfigs in these headers are reliable findings on almost every program.
- JavaScript Basics - DOM, fetch API, event handlers, postMessage, prototype chain. Essential to understand and exploit client-side vulnerabilities like XSS and prototype pollution.
Web Fundamentals - Recommended Books
Stage 3: Cloud & DevOps
Modern targets live in the cloud. IAM misconfigs, exposed S3 buckets, CI/CD secrets, and container escapes are high-impact goldmines for bug hunters.
Cloud & DevOps - Key Topics
- AWS Security - IAM roles, S3 bucket misconfigs, EC2 metadata service (SSRF→IMDS), Lambda, API Gateway. SSRF to IMDS is a classic high-severity attack chain.
- GCP Security - Google Cloud IAM, Cloud Storage ACLs, Cloud Run, GKE. GCP's metadata server at 169.254.169.254 is a top SSRF target.
- Azure Security - Azure AD, Managed Identities, Blob Storage, Function Apps. Over-permissioned service principals are growing bug bounty targets.
- CI/CD Pipelines - GitHub Actions, Jenkins, GitLab CI - poisoned pipeline execution (PPE), exposed GITHUB_TOKEN, self-hosted runner takeovers. High-impact, often overlooked.
- Git & Secrets - Exposed .git directories, git history mining for secrets, hardcoded API keys in commits. TruffleHog and gitleaks automate the search.
- Docker & K8s - Container escapes, exposed Docker daemon socket, Kubernetes RBAC misconfigs, etcd exposure. Container attack surface is massive in modern programs.
Cloud & DevOps - Recommended Books
Stage 4: Vulns & Tools
The heart of bug bounty. Learn every OWASP vulnerability category deeply, master Burp Suite, and practice PortSwigger labs daily until the patterns become instinct.
Vulns & Tools - Key Topics
- OWASP Top 10 - The canonical web vulnerability categories. Learn each one technically - not just the name but root cause, bypass techniques, and chained impact.
- LLM / AI Security - Prompt injection, indirect prompt injection, training data extraction, model inversion. AI attack surface is exploding - early movers find the best bugs.
- Burp Suite - Proxy, Scanner, Repeater, Intruder, Collaborator, Extensions (Turbo Intruder, Param Miner). Mastering Burp is non-negotiable for web bug bounty.
- Crawling & Gau - Katana for active crawling of JS-heavy apps, Gau for historical URL fetching from Wayback/URLScan. Build a complete URL inventory before hunting.
- Dir Brute-Forcing - FeroxBuster and FFUF for finding hidden directories, admin panels, backup files, and unlinked API endpoints that scanners miss.
- Nuclei Scanning - YAML-template vulnerability scanning with 4000+ community templates. Great for quickly identifying low-hanging fruit and known CVEs across attack surface.
- XSS - Reflected, stored, DOM-based XSS. Filter bypass, CSP bypass, mutation XSS (mXSS), dangling markup. DalFox automates detection.
- SQL Injection - Error-based, union-based, blind boolean/time, OOB SQLi. Database type changes the attack path. SQLMap automates exploitation.
- SSRF - Server-Side Request Forgery - make the server fetch internal resources. SSRF to cloud metadata (AWS IMDS, GCP) → credential theft → account takeover.
- IDOR / BOLA - Insecure Direct Object Reference / Broken Object Level Authorization. Swapping IDs in API calls to access other users' data. Highest volume bug bounty bug class.
- CSRF - Cross-Site Request Forgery - trick the browser to make authenticated requests. SameSite bypass, JSON CSRF, multipart CSRF.
- XXE - XML External Entity injection via XML parsers. File disclosure, SSRF, RCE via blind XXE with OOB channels using interactsh or Burp Collaborator.
- File Upload Vulns - Unrestricted file upload → RCE via webshell, stored XSS via SVG upload, path traversal in filename. Content-type bypass techniques.
- Path Traversal - Directory traversal (../../etc/passwd), URL encoding bypasses (%2e%2e%2f), null bytes, zip slip. Often combined with file read to leak source code.
- RCE / Command Inj - Remote Code Execution via deserialization, SSTI, command injection, argument injection. Highest severity bug - often $10k-$100k+ on major programs.
- JWT Attacks - alg:none bypass, HS256/RS256 key confusion, kid injection, jwks spoofing. JWT vulnerabilities allow complete authentication bypass.
- CORS Misconfig - Wildcard origins, null origin trust, subdomain origin trust. Misconfigured CORS + sensitive endpoints = cross-origin data exfiltration.
- HTTP Smuggling - CL.TE / TE.CL / TE.TE request smuggling. Cache poisoning, session hijacking, WAF bypass. PortSwigger has 20+ labs on this topic.
- Prototype Pollution - Polluting Object.prototype in JavaScript. Leads to XSS, RCE in Node.js, privilege escalation in client-side logic.
- Subdomain Takeover - Unclaimed CNAME records pointing to cloud services (Heroku, GitHub Pages, Azure, etc.). subzy automates detection. High signal-to-noise.
- Business Logic - Negative quantity orders, price manipulation, coupon stacking, referral abuse. Requires understanding the app deeply - hard to automate, high reward.
- Race Conditions - TOCTOU bugs - two requests processed concurrently leading to double-spend or auth bypass. Turbo Intruder makes testing easy.
Vulns & Tools - Recommended Books
- Real World Bug Hunting by Peter Yaworski - Field guide with real disclosed reports analyzed and explained. Shows the methodology behind real bug discoveries - how researchers thought, not just what they found.
- Bug Bounty Bootcamp by Vickie Li - Structured curriculum from recon to reporting, written specifically for bug bounty. The best single book for someone starting their bug bounty journey.
- Hacking APIs by Corey J. Ball - API attack surface: REST, GraphQL, SOAP. Auth bypass, BOLA, BFLA, mass assignment, rate limiting bypass. The only dedicated book on API hacking.
- Penetration Testing by Georgia Weidman - Covers the full penetration testing methodology with Metasploit and custom exploits. Great bridge between beginner concepts and real-world offensive techniques.
Stage 5: BB Platforms
Understand the ecosystem. Where programs live, VDP vs BBP, how scopes work, and how to read program briefs to find targets others skip.
BB Platforms - Key Topics
- HackerOne - The largest bug bounty platform. 3000+ programs, rich Hacktivity feed of public reports, and Hall of Fame. Start here.
- Bugcrowd - Second largest platform. Bugcrowd University has free structured courses. Great for finding less-crowded private programs.
- Immunefi (Web3) - Crypto and DeFi bug bounties. Highest payouts in the industry - $1M+ for critical smart contract vulnerabilities.
- VDP vs BBP - Vulnerability Disclosure Programs carry no legal risk - perfect for practice. Bug Bounty Programs pay real money. Start with Google VRP, Microsoft.
- Intigriti / EU - Intigriti (EU), YesWeHack (France), Yogosha. Less competition than HackerOne. Many EU company programs with active triagers.
- Finding Programs - Google dork for programs: intext:"responsible disclosure" OR site:hackerone.com. Reading security.txt at /.well-known/security.txt.
BB Platforms - Recommended Books
Stage 6: Recon & Scripting
Automation separates good hunters from great ones. Google dorks, Python scripting, and a solid recon pipeline let you find bugs others simply never see.
Recon & Scripting - Key Topics
- Google Dorks - site:, intitle:, inurl:, filetype:, ext:, cache:, before:/after: operators. Passive recon that surfaces exposed files, login pages, and admin panels.
- Yandex Dorks - Yandex indexes the Russian-speaking internet and caches differently. Often surfaces endpoints and subdomains Google misses.
- Python Scripting - requests, subprocess, asyncio, argparse, BeautifulSoup. Automate recon pipelines, parameter fuzzing, custom scanners, and report generation.
- GraphQL Security - Introspection leaks entire schema, BOLA via GraphQL, batch query abuse (rate limit bypass), field-level auth bypass, alias-based DoS.
- Recon Pipeline - Subfinder → Httpx → Katana → Nuclei → manual review. Automated asset discovery that runs continuously, alerting on new attack surface.
- Mobile / APK - APK decompilation with jadx, traffic interception with Burp + Frida, hardcoded secrets in mobile apps. Mobile programs are less crowded and pay well.
- OSINT Techniques - LinkedIn for employee enumeration, Shodan/Censys for exposed assets, GitHub for leaked secrets, Wayback Machine for old endpoints.
- Automation & Alerts - GitHub Actions / cron for continuous recon, notify-me pipelines (Slack/Telegram) for new subdomains or exposed services. Hunt 24/7 via automation.
Recon & Scripting - Recommended Books
- Black Hat Bash by No Starch Press - Offensive bash scripting: port scanners, exploit automation, reconnaissance scripts. Takes your shell scripting from sys-admin tasks to offensive security tooling.
- Black Hat Python 2nd Ed by Justin Seitz - Build offensive security tools in Python - network sniffers, web fuzzers, keyloggers, trojans. Essential for any hacker who wants to write their own tools.
- Black Hat Go by Steele, Patten & Kottmann - Write security tools in Go - fast, cross-platform binaries. Network scanners, packet processors, DNS tools. Go is increasingly the language of modern security tooling.
- Beyond the Basic Stuff by Al Sweigart - Moves past hello-world Python into real programs, OOP, testing, and CLI tools. Solid foundation for writing your own bug bounty automation scripts.
- Black Hat GraphQL by Farhi & Aleks - Deep GraphQL exploitation: introspection abuse, DoS via complex queries, auth bypass, injection attacks. Read alongside Hacking APIs for complete API coverage.
- Make Python Talk by NPG Technology - Practical Python projects - great for building notification bots and alert systems that message you when recon finds something interesting.
- The Book of Ruby by Huw Collingbourne - Complete Ruby guide. Metasploit is written in Ruby - understanding Ruby helps you write custom Metasploit modules and read existing exploit code.
Stage 7: Active Hunting
Start hunting. Read disclosed reports daily, write quality PoC submissions, build your reputation, and collaborate with other researchers to unlock private programs.
Active Hunting - Key Topics
- Writing Reports - CVSS scoring, clear impact narrative, step-by-step PoC, remediation advice, screenshots/videos. A great report gets triaged faster and paid more.
- VDP Submissions - Google VRP, Microsoft MSRC, Meta Bug Bounty, GitHub Security Lab, Apple Security. Build reputation and skills without financial pressure.
- BBP Submissions - Pick mid-tier programs first - fewer hunters, faster triage. Read the program scope carefully and find the parts nobody has tested.
- Reading Writeups - Read 1-2 writeups per day minimum. Understand the methodology - what made the researcher look there? Pattern recognition is the real skill.
- CTF & Labs - PicoCTF, HTB, TryHackMe, OverTheWire. Safe environments to practice techniques. CTF skills directly transfer to real bug bounty.
- Program Selection - Read program stats - response time, signal ratio, average bounty. Some programs are goldmines; others are ghost towns. Pick wisely.
- Collaboration - Discord servers (BBH, Hacker0x01), Twitter/X security community, private invite-only groups. The security community is generous - ask good questions.
Active Hunting - Recommended Books
- Ikigai by García & Miralles - Find your reason to keep going when hunting gets hard. Why are you doing this? Ikigai helps you find the intersection of passion, skill, and purpose.
- Thinking, Fast and Slow by Daniel Kahneman - System 1 (intuition) vs System 2 (analysis) thinking maps directly onto security - fast pattern recognition for recon, slow systematic analysis for complex bugs.
- Meditations by Marcus Aurelius - Stoic resilience for the long game. Bug bounty hunting has many rejections, duplicates, and N/A responses - learn to process them with equanimity.
Stage 8: Exploit Development
Turn a crash into control. Memory corruption, ROP, heap exploitation, and mitigation bypass - the deep technical skillset behind real RCEs, not just web app bugs. An optional but powerful branch for hunters chasing the highest-payout findings.
Exploit Development - Key Topics
- Memory Corruption - Stack overflows, heap overflows, use-after-free, double-free, type confusion. This is the root cause behind the vast majority of critical CVEs - understand it and every other exploit primitive starts making sense.
- ROP Chains - Return-Oriented Programming chains gadgets from existing code to execute arbitrary logic without injecting shellcode. The go-to technique once DEP/NX makes the stack non-executable.
- Heap Exploitation - UAF, double-free, heap grooming/feng-shui, house-of-* techniques against glibc malloc internals. Modern browser and kernel 0-days live almost entirely in the heap.
- Shellcoding - Writing raw machine code by hand (egg-hunters, staged payloads, encoders) to pop a shell once you control execution flow. The last mile between "I control RIP" and "I have a shell."
- Mitigation Bypass - Defeating ASLR, DEP/NX, stack canaries, and CFI/CET through info leaks, partial overwrites, and JOP/COOP. Every mitigation ships with a bypass technique - knowing both sides is what separates a script kiddie from an exploit dev.
- Linux Exploit Dev - ret2libc, ret2plt, format string exploitation, and glibc-specific tricks on ELF binaries. The default playground for CTF pwn and most public 1-day exploits.
- Windows Exploit Dev - SEH overwrites, egghunters, DEP/ASLR bypass on PE binaries, and the OSED-style skillset. A completely different toolchain and mindset from Linux, and where most commercial exploit dev jobs live.
- Kernel Exploitation - Escalating a userland bug into ring-0 code execution via driver IOCTL bugs, token stealing, or pool overflows on Linux/Windows kernels. The final boss of local privilege escalation.
- Browser Exploitation - Type confusion and UAF bugs in V8/JSC/SpiderMonkey turned into JS-only exploit primitives, then chained into sandbox escapes. The highest-value, highest-payout 0-days in the industry live here.
- CTF Pwn - Timed binary exploitation challenges that force you to combine every technique above under pressure. The fastest feedback loop for building real exploit-dev muscle memory.
Exploit Development - Recommended Books
Stage 9: Vulnerability Research
Find bugs nobody has found yet. Reverse engineering, fuzzing, and patch diffing let you discover 0-days in closed-source software instead of only hunting known bug classes in web apps.
Vulnerability Research - Key Topics
- x86/x64 Assembly - Reading and writing raw machine instructions, calling conventions, and register/stack layout. Non-negotiable bedrock - you cannot reverse engineer or exploit what you cannot read at the instruction level.
- Reverse Engineering - Recovering program logic, data structures, and intent from stripped binaries using disassemblers and decompilers. The core skill for finding bugs in software you don't have source code for.
- Binary Analysis - Combining static code inspection with runtime instrumentation and tracing to understand exactly how untrusted input flows through a target. Static tells you what could happen; dynamic proves what does happen.
- Fuzzing - Throwing mutated or generated inputs at a target at scale (AFL++, libFuzzer, honggfuzz) to auto-discover crashes no human would think to try. The single highest-ROI technique in modern vulnerability research.
- Debugging Toolchains - Stepping through crashes with gdb/pwndbg on Linux or WinDbg on Windows to turn a fuzzer crash or a hunch into a root-caused, reproducible bug. Where "it crashed" becomes "here's exactly why."
- Symbolic Execution - Using tools like angr to explore program paths mathematically instead of empirically, solving constraints to reach deeply nested code paths fuzzers struggle to find. Especially powerful for CTF and small, self-contained targets.
- Patch Diffing - Comparing patched vs. unpatched binaries (bindiff-style) to pinpoint exactly what a silent vendor patch fixed, then racing to weaponize it before defenders update. This is how most public "1-day" exploits and N-day research gets done.
- Mobile Exploitation - Reversing APKs/IPAs, bypassing root/jailbreak detection, and exploiting native libraries or the kernel underneath. A rapidly growing, high-payout niche as web/cloud targets get better-defended.
Vulnerability Research - Recommended Books
- Practical Binary Analysis by Dennis Andriesse - A hands-on guide to ELF internals, binary instrumentation, taint analysis, and symbolic execution, building your own tools instead of just using off-the-shelf ones.
- The Art of Software Security Assessment by Dowd, McDonald & Schuh - The 1000+ page bible of vulnerability discovery - exhaustively catalogs bug classes across C/C++, networking, and web, and how to audit source code for them.
- Gray Hat Hacking by Daniel Regalado et al. - A broad, frequently-updated survey covering exploit dev, reverse engineering, malware analysis, and fuzzing - a good map of the entire vuln-research landscape before you specialize.
- Fuzzing: Brute Force Vulnerability Discovery by Sutton, Greene & Amini - The foundational text that turned fuzzing from folklore into a discipline - still the best explanation of why fuzzing works and how to build a fuzzing framework from scratch.
Practice Platforms & Labs for Bug Bounty
- PortSwigger Academy - Free world-class web security labs. 200+ guided labs covering every OWASP topic with detailed explanations. Your primary practice ground - complete all apprentice labs first.
- TryHackMe - Guided learning paths for beginners with browser-accessible machines. Start with the "Jr Penetration Tester" path - no setup required.
- HackTheBox - Challenging retired and active machines for intermediate to advanced learners. Solving HTB machines builds serious enumeration and exploitation skills.
- HTB Academy - Structured learning modules with HTB quality. The Bug Bounty Hunter and Web Application Penetration Tester paths are excellent and comprehensive.
- PicoCTF - Carnegie Mellon's beginner CTF platform. Great entry point into web exploitation, crypto, forensics, and binary challenges. Completely free.
- Root-Me - 1000+ challenges in web, network, forensics, and reverse engineering. Highly underrated - less crowded than HTB with excellent web challenges.
- OverTheWire - Linux wargames from beginner (Bandit) to advanced (Narnia, Behemoth). The best Linux command-line practice available anywhere. Start with Bandit.
- PentesterLab - Structured exercises with code review components and a badge system that demonstrates real skill to potential employers. Excellent for web vuln fundamentals.
- HackerOne - Largest bug bounty platform with 3000+ programs. The Hacktivity feed shows all public disclosed reports - an endless stream of real-world hacking education.
- Bugcrowd - Second largest platform. Bugcrowd University provides free structured bug bounty education. Great for finding private programs with less competition.
- Immunefi - Web3 and DeFi bug bounties with the highest payouts in the industry - $1M+ for critical smart contract vulnerabilities. High risk, very high reward.
- Intigriti - European bug bounty platform with many EU company programs. Less competition than HackerOne/Bugcrowd. Active and responsive triage team.
- YesWeHack - French bug bounty platform growing rapidly. Good programs with less competition than the major platforms. Strong European company presence.
- VulnHub - Download and run vulnerable VMs locally. No internet required - great for offline practice and understanding full compromise chains.
- Pwned Labs - Cloud security labs for AWS, Azure, and GCP. Real cloud environments to practice cloud attack techniques before hunting on live programs.
- API Security University - Free courses dedicated entirely to API security testing. Essential companion to the Hacking APIs book - practice what you read.
- Hacker101 - HackerOne's free security training platform. CTF challenges earn you invitations to private HackerOne programs - a direct pipeline to exclusive targets.
- flaws.cloud - AWS security challenge by Scott Piper. Work through real-world AWS misconfiguration scenarios - S3 buckets, IAM roles, EC2 metadata. Free and excellent.
- DVWA - Damn Vulnerable Web Application - deliberately insecure PHP web app. Classic practice target for SQLi, XSS, CSRF, file upload, command injection.
- Bugcrowd University - Free structured bug bounty education from Bugcrowd covering recon, vulnerability classes, and reporting. Official training pathway for Bugcrowd hunters.
- ROP Emporium - Hands-down the best structured intro to ROP chaining, walking you from a basic ret2win up through pivoting and Windows ROP across x86/x64.
- pwn.college - Arizona State's free, ridiculously thorough binary exploitation curriculum (from assembly to kernel pwn) with an auto-graded Docker-based lab environment.
- exploit.education - Successor to the legendary "Nebula"/"Protostar" VMs - progressive VM-based wargames covering memory corruption from first principles.
- RET2 Wargames - Paid but excellent progressive pwn challenges built by RET2 Systems, a boutique vuln research firm - bridges the gap between CTF and real-world exploit dev.
- pwnable.kr - One of the oldest and most respected pwn-focused wargames, ranging from trivial to brutally hard, with a scoring system that tracks your growth.
- pwnable.tw - Taiwan-based sister site to pwnable.kr, leaning harder into glibc heap exploitation and modern mitigation bypasses.
- OpenSecurityTraining2 - Free, university-caliber, self-paced courses (many taught by veteran vuln researchers) on RE, exploit dev, and x86/ARM architecture - one of the best free deep-dive catalogs available.
- crackmes.one - A huge community-submitted archive of reverse-engineering "crackmes" ranging from trivial to protected-and-obfuscated, with difficulty ratings - the RE equivalent of CTF pwn practice.
- CTFtime - The central calendar and rating system for CTF competitions worldwide - the easiest way to find live pwn/RE-heavy CTFs and gauge team/player skill via ratings.
- Exploit-DB - The largest public archive of exploits and PoCs (with the companion SearchSploit tool and Google Hacking Database) - invaluable for studying how real vulnerabilities were actually weaponized.
Essential Bug Bounty Tools
- Burp Suite - Industry-standard web proxy. Intercept, modify, replay requests. Extensions: Param Miner, Turbo Intruder, JWT Editor, Active Scan++. The single most important tool.
- Nuclei - Fast YAML-based vulnerability scanner with 4000+ community templates. Run against your full attack surface to quickly surface known CVEs and misconfigs.
- Katana - Fast, configurable web crawler by ProjectDiscovery. Handles JavaScript-heavy apps, discovers endpoints, parameters, and form fields at scale.
- Gau - Get All URLs - fetches known URLs from Wayback Machine, OTX, URLScan.io, and CommonCrawl. Finds old and forgotten endpoints.
- FeroxBuster - Fast recursive content discovery written in Rust. Finds hidden directories, backup files, and admin panels that crawlers miss. Highly configurable.
- Subfinder - Passive subdomain discovery using 50+ data sources (CertSH, VirusTotal, Shodan, etc.). First step in every serious recon pipeline.
- Httpx - Fast HTTP probing tool. Filter live hosts from subdomain lists, grab titles/status codes/tech stack, and find interesting targets to investigate.
- Amass - OWASP in-depth attack surface mapping. Combines passive and active subdomain enumeration with ASN discovery and relationship graphing.
- RustScan - Scans all 65535 ports in seconds, then hands off to Nmap for service detection. Makes full-port Nmap scans 100x faster.
- Nmap - The network scanner. Port discovery, service version detection, OS fingerprinting, NSE scripts for vulnerability detection and exploitation.
- SQLMap - Automated SQL injection detection and exploitation. Supports all major databases, union-based, blind, and OOB extraction.
- FFUF - Fast web fuzzer for directories, parameters, virtual hosts, and headers. Very flexible - fuzz any position in the HTTP request with any wordlist.
- TruffleHog - Scans git repositories for secrets, API keys, and credentials in commit history. Finds secrets that developers accidentally committed.
- DalFox - Powerful XSS scanner written in Go. Parameter analysis, DOM-based XSS detection, custom payload injection, and Blind XSS support.
- Subzy - Subdomain takeover vulnerability checker. Checks against 50+ services (Heroku, GitHub Pages, Azure, Shopify) for unclaimed CNAME records.
- Waybackurls - Fetch all URLs for a domain from the Wayback Machine. Surfaces old endpoints, deprecated APIs, and forgotten paths that may still be vulnerable.
- Interactsh - Out-of-band interaction server for detecting blind vulnerabilities (blind XSS, blind SSRF, blind XXE). The open-source alternative to Burp Collaborator.
- Shodan - Search engine for internet-connected devices. Find exposed services, cameras, industrial systems, and misconfigured cloud assets on a target's ASN.
- Postman - API testing and exploration platform. Build collections of API requests, test auth flows, and chain requests. Essential for methodical API security testing.
- Anew - Append lines from stdin to a file, printing only new lines. The glue tool in recon pipelines - deduplicate URLs, subdomains, and endpoints automatically.
- pwntools - The Python CTF/exploit-dev framework: process/socket wrangling, ELF parsing, ROP automation, and shellcode generation in one library. If you write exploits, you use pwntools.
- ROPgadget - Scans binaries for usable ROP/JOP gadgets and can auto-build chains - turns "find a gadget that pops rdi" from a manual grep into a one-liner.
- pwndbg - GDB is the standard Linux debugger, but pwndbg bolts on heap-chunk visualization, one-shot ASLR-defeat helpers, and exploit-dev-focused context views that stock GDB sorely lacks.
- one_gadget - Finds single "magic" addresses inside libc that pop a shell in one jump, given the right register constraints - a staple of ret2libc chains.
- checksec - Instantly reports which mitigations (canary, NX, PIE, RELRO) a binary was compiled with, telling you which exploit techniques are even on the table.
- x64dbg - Open-source, feature-rich user-mode Windows debugger with a plugin ecosystem - the closest Windows equivalent to gdb+pwndbg for exploit dev.
- QEMU - Full-system emulator used to spin up kernels, embedded firmware, and exotic architectures for safe exploit development and fuzzing without risking real hardware.
- Ghidra - NSA's free, full-featured disassembler/decompiler with a scripting API - the open-source tool that made high-quality decompilation accessible to everyone.
- IDA Free - The free tier of the industry-standard disassembler; IDA Pro (with the Hex-Rays decompiler) is still the gold standard most professional vuln researchers work in daily.
- Binary Ninja - A modern, scriptable disassembler/decompiler with a clean API and IL layers (LLIL/MLIL/HLIL) purpose-built for writing analysis tooling on top of it.
- radare2 / Cutter - A free, scriptable, command-line-first reverse engineering framework; Cutter bolts a Ghidra-decompiler-powered GUI on top for people who want radare2's power without memorizing every command.
- AFL++ - The actively-maintained, community-driven successor to AFL - the de facto standard coverage-guided fuzzer, packed with mutators, instrumentation modes, and QEMU/persistent-mode support.
- libFuzzer - An in-process, coverage-guided fuzzer built into LLVM/Clang - the easiest way to fuzz a single C/C++ function with zero setup overhead.
- angr - A Python binary analysis framework combining symbolic execution, static analysis, and CFG recovery - the tool of choice for solving CTF reversing challenges and automating exploit generation research.
- Frida - A dynamic instrumentation toolkit that injects JavaScript into running processes on Linux/Windows/macOS/iOS/Android - indispensable for hooking functions and tracing behavior on mobile targets.
- Assetfinder - Fast Go tool that finds domains/subdomains related to a target by querying crt.sh, VirusTotal, Wayback Machine, etc.; a recon-workflow staple.
- Unfurl - CLI tool that pulls structured pieces (domains, paths, params, values) out of large URL lists piped via stdin, used constantly in bug bounty triage pipelines.
- gf - A grep wrapper for saving and replaying common vulnerability-hunting patterns - finding potential SSRF/XSS/SQLi sinks in URL corpora becomes a one-liner.
- meg - Efficiently fetches many paths across many hosts while being polite to servers, useful for bulk endpoint probing.
- reconFTW - Automated, modular recon framework (subdomain enum, vuln scanning, OSINT) that chains together most well-known recon tooling.
- Kiterunner - Assetnote's contextual content-discovery tool that bruteforces modern API routes using real Swagger/OpenAPI specs rather than naive wordlists.
Best Bug Bounty Write-ups, Blogs & References
- Project Zero - Google's elite security research team. Deep technical posts on 0-days, browser exploitation, and advanced vulnerabilities. The gold standard of security research.
- Infosec Writeups - Curated Medium publication with hundreds of bug bounty writeups published weekly. Essential daily reading - bookmark and check every morning.
- Weekly Infosec - Weekly curated digest of the best infosec writeups from across the internet. Subscribe to the newsletter to never miss a great technique.
- Pentester Land - Indexed database of bug bounty writeups organized by vulnerability type. Want to learn SSRF? Filter by SSRF. The best organized writeup resource available.
- H1 Hacktivity - HackerOne's public disclosure feed. Real paid reports from real programs with actual triager comments. Read 5 per day and study the methodology.
- Bug Bounty Hunter - Aggregated disclosed reports from multiple platforms. Searchable by vulnerability type. Great for studying patterns in how specific bugs are found.
- PortSwigger Research - Web security research blog from Burp Suite creators. HTTP desync, request smuggling, prototype pollution, cache poisoning - cutting-edge techniques explained.
- Google VRP Writeups - Curated list of Google VRP bug bounty writeups covering XS-Search, OAuth attacks, Cloud misconfigs, and more. Maintained by David Schütz.
- Embrace The Red - AI and LLM security research blog. Prompt injection in real applications, LLM exploitation, AI attack surface exploration. Essential as AI bugs emerge.
- Awesome BB Writeups - GitHub repo with 500+ curated writeups organized by vulnerability category. When learning a new vuln type, start here for real-world examples.
- Writeups.io - Clean interface for browsing bug bounty writeups. Filter by platform, bug type, and bounty amount. Great for finding high-payout techniques.
- Orange Tsai Blog - Research blog by Orange Tsai - one of the world's best security researchers. SSRF chains, RCE, server-side vulns. Every post is a masterclass in creative exploitation.
- Sam Curry Blog - Sam Curry's blog featuring car hacking, subdomain takeovers, and massive auth bug chains. Known for finding critical bugs in Apple, GM, and major tech companies.
- HackTricks - The comprehensive hacking wiki. Every attack technique, tool, and methodology documented with examples. The reference you'll open every single day.
- PayloadsAllTheThings - Curated payload collections for every vulnerability type. SQLi payloads, XSS vectors, SSRF bypasses, path traversal strings. The payload library every hunter needs.
- SecLists - The world's best wordlist collection - directories, passwords, fuzzing strings, user agents. Used by ffuf, feroxbuster, and every directory scanner.
- OWASP Cheat Sheet - OWASP's comprehensive cheat sheets covering both attack and defense for every vulnerability class. The authoritative reference for understanding web security controls.
- HowToHunt - Step-by-step hunting methodology for each vulnerability type. XSS - where to look, what to try. SSRF - how to find it. Organized by vuln class for quick reference.
- LiveOverflow YouTube - Deep technical security content on YouTube. CTF walkthroughs, exploit development, browser security. The best free security education on YouTube.
- STÖK YouTube - Bug bounty methodology, mindset, and community content by STÖK. Shows real hunting sessions, tool workflows, and how to stay motivated for the long game.
- how2heap - Shellphish's hands-on collection of glibc heap exploitation techniques (house-of-force, tcache poisoning, etc.), each with a minimal runnable PoC - the definitive heap-exploitation reference.
- nightmare - A free 90+ challenge binary exploitation/RE course built entirely around real CTF problems, progressing from stack smashing to advanced heap and kernel pwn.
- Modern Binary Exploitation - RPI's full university course materials, labs, and VM for binary exploitation - one of the most cited free academic pwn curricula on the internet.
- HackSysExtremeVulnerableDriver - An intentionally vulnerable Windows (and now Linux) kernel driver purpose-built for practicing kernel exploitation techniques safely.
- heap-exploitation - A free online book dissecting glibc malloc internals and walking through every major heap attack - the conceptual companion to how2heap's PoCs.
- Corelan Team Tutorials - The legendary tutorial series that taught a generation of researchers Windows exploit dev, from basic stack overflows through SEH bypass and heap spraying.
- Phrack Magazine - The oldest and most legendary hacker e-zine (since 1985); its technical "philes" on exploitation techniques have originated entire subfields of vulnerability research.
- Awesome-Fuzzing - A curated master-list of fuzzing books, papers, tools, tutorials, and vulnerable targets - the fastest way to go from "what is fuzzing" to a working toolchain.
- Awesome-CVE-PoC - A curated, actively-updated index of public CVE proof-of-concept exploits - great for studying real-world bug patterns instead of only synthetic CTF ones.
- Awesome Windows Kernel Security - A dense curated list of Windows kernel security resources (drivers, rootkits, WinDbg tooling, mitigations) for anyone going deep on Windows kernel research.
- Trail of Bits Blog - Technical write-ups from one of the most respected offensive-security research firms, covering fuzzing infra, binary analysis tooling, and real vulnerability deep-dives.
- OALabs YouTube - Free, highly practical reverse-engineering and malware-analysis livestreams/tutorials covering Ghidra, unpacking, and de-obfuscation techniques on real-world samples.
- Bug Bounty Cheatsheet - A widely-referenced list of interesting payloads, tips, and tricks spanning XSS, SSRF, SQLi and recon, maintained by a well-known bug bounty researcher.
- The Bug Hunter's Methodology - Jason Haddix's canonical recon/methodology repo covering recon, mapping, and app-testing methodology across multiple versions.
- Nuclei Templates - The official, community-curated template library for the Nuclei scanning engine, covering thousands of CVEs, misconfigurations, and exposure checks.
- Bug Bounty Reference - Curated index of public disclosed bug bounty reports organized by vulnerability class (XSS, SQLi, CSRF, SSRF, RCE, etc.).
- API Security Checklist - A widely-used checklist of security countermeasures for designing/testing/releasing APIs, translated into 30+ languages.
- OWASP WSTG - OWASP's comprehensive open-source methodology/guide for testing web application and web service security.
- Bounty Targets Data - Auto-updated data dump of in-scope domains/wildcards from HackerOne, Bugcrowd, Intigriti and other bounty platforms - great for building your own target list.
- Awesome Bug Bounty - The original "awesome list" style aggregator of write-ups, getting-started resources, and program links.
- Resources for Beginner Hunters - A long-standing, heavily-starred beginner resource hub from bug bounty streamer nahamsec covering tools, labs, mobile hacking, and getting-started material.