Structured practice: Mainly PortSwigger lab writeups
☆23Oct 19, 2026Updated this week
Alternatives and similar repositories for Bug-bounty-writeups
Users that are interested in Bug-bounty-writeups are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- PoC for CVE-2026-87902 — unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with…☆39Sep 22, 2026Updated 3 weeks ago
- Hardener Plus is an advanced security auditing platform for modern web architectures. It employs dynamic profiling and deep heuristics to…☆82Sep 10, 2026Updated last month
- PoC for CVE-2026-66066 in Ruby on Rails☆23Jul 30, 2026Updated 2 months ago
- The AI Autonomous SOC & Purple-Team Engine☆29Aug 11, 2026Updated 2 months ago
- ☆75Jul 15, 2026Updated 3 months ago
- Simple, predictable pricing with DigitalOcean hosting • AdAlways know what you'll pay with monthly caps and flat pricing. Enterprise-grade infrastructure trusted by 600k+ customers.
- CVE-2026-75604 Next.js Windows RCE poc☆105Aug 28, 2026Updated last month
- Next.js RCE☆53Sep 29, 2026Updated 3 weeks ago
- Stealth hybrid URL mapper☆38May 1, 2026Updated 5 months ago
- Reusable prompts for a structured, evidence-first bug bounty hunting workflow☆686Oct 3, 2026Updated 2 weeks ago
- A proof-of-concept PDF file designed for authorized security testing of PDF upload functionality and PDF viewer behavior, including XSS a…☆77Aug 28, 2026Updated last month
- ☆53Sep 9, 2026Updated last month
- Parse HTB modules into fully offline HTML with images, code highlighting, and sidebar navigation. 📥📚☆17Nov 20, 2025Updated 11 months ago
- Collection of documentation, tools, and tips related to vulnerability research.☆274Sep 24, 2026Updated 3 weeks ago
- Claude Code plugin for writing triager-grade bug bounty reports☆297Aug 25, 2026Updated last month
- Deploy on Railway without the complexity - Free Credits Offer • AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- ☆77May 5, 2025Updated last year
- Agent skill for rigorous bug bounty report triage, validation, severity escalation, and submission-ready reporting.☆139Oct 9, 2026Updated last week
- Automated adversary emulation (Caldera) against an AD lab to validate Sigma detection coverage and map results to MITRE ATT&CK.☆57Sep 25, 2026Updated 3 weeks ago
- 403 Access Bypass Tester☆125Oct 13, 2026Updated last week
- Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integrati…☆369Aug 15, 2026Updated 2 months ago
- Burp Suite extension to find hardcoded secrets & hidden endpoints in JavaScript. 150+ detection patterns, active JS fetch, low-noise fals…☆97Sep 10, 2026Updated last month
- A 2d javaScript game built without any libraries☆11Oct 30, 2022Updated 3 years ago
- Learning python programming and scripting.☆13Jul 30, 2025Updated last year
- A smart fuzzing and parameter injection tool designed to discover reflections and identify potential XSS attack vectors.☆38Oct 13, 2026Updated last week
- Serverless GPU API endpoints on Runpod - Get Bonus Credits • AdSkip the infrastructure headaches. Auto-scaling, pay-as-you-go, no-ops approach lets you focus on innovating your application.
- Behavioral-discipline skill turning an AI agent into a methodical, non-robotic bug-bounty & pentest hunter - 42 always-on rules: scope, c…☆35Aug 18, 2026Updated 2 months ago
- Comment2Shell is a zero click pre auth RCE exploit for WordPress CVE-2026-93485. An anonymous comment plants stored XSS that fires when a…☆65Oct 6, 2026Updated 2 weeks ago
- Personal Web Application Pentesting Methodology built during my cybersecurity learning journey. Covers reconnaissance, scanning, fuzzing,…☆59Jul 24, 2026Updated 2 months ago
- IP obfuscation and URL generator.☆47Dec 8, 2025Updated 10 months ago
- Replay any request as another user to find IDOR/BOLA/BFLA, right in the browser.☆29Jun 16, 2026Updated 4 months ago
- A library to build Control and Data Flow Graphs from binary code☆18Updated this week
- Red Team Operations Framework☆30Jul 14, 2024Updated 2 years ago
- The Native Reverse Engineering IDE. Zero-overhead binary analysis, full CPU emulation (PE/ELF), and headless automation. Powered by Capst…☆26Sep 23, 2026Updated 3 weeks ago
- Local-first AI red team for web, API, and LLM application security. Attacker-style reasoning, evidence-backed findings, and skills for AI…☆336Sep 14, 2026Updated last month
- Managed Database hosting by DigitalOcean • AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- A GPT-6 Astra agent that runs a live board of every Robinhood Stock Token against its real price and calls the gap while the real NYSE is…☆34Sep 15, 2026Updated last month
- A complete bug bounty workspace for HackerOne researchers. Includes scope enforcement, automated recon/vuln pipeline (400+ tools), report…☆481Updated this week
- Community curated list of templates for the nuclei engine to find security vulnerabilities.☆111Nov 24, 2025Updated 10 months ago
- ⚔️ Community maintained directory, MCP and API of 3,000+ active bug bounty programs and VDPs☆446Updated this week
- CVE-2026-57827 — RSFiles! Joomla Component Unauthenticated File Upload RCE. Split-controller upload bypass. CVSS 9.8 | CWE-434 | com_rsfi…☆16Jul 29, 2026Updated 2 months ago
- A live map of every memecoin on Robinhood Chain that trades against a tokenized stock☆18Sep 9, 2026Updated last month
- An advanced Out-of-Band and In-Band SSRF fuzzing scanner with dynamic request tracking.☆40Jun 18, 2026Updated 4 months ago