π A list of writeups from the MSRC (Microsoft) Bug Bounty program
β44Oct 29, 2025Updated 11 months ago
Alternatives and similar repositories for awesome-msrc-writeups
Users that are interested in awesome-msrc-writeups are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- Android webviews and securiyβ25Jul 19, 2026Updated 2 months ago
- A BugBounty playbook covering vulnerability bypasses, payloads, and quick checks for OWASP Top 10 + extras.β23Sep 29, 2025Updated last year
- JSSCM detects expired domains for Stored XSS exploitation during browsing.β58Apr 3, 2025Updated last year
- web app monitoring automationβ15Jan 7, 2025Updated last year
- A collection of ctf 'web-pwn' challenges, which require the exploitation of memory-related vulnerabilities within essential web componentβ¦β16Oct 2, 2024Updated 2 years ago
- Managed hosting for WordPress and PHP on Cloudways β’ AdManaged hosting for WordPress, Magento, Laravel, or PHP apps, on multiple cloud providers. Deploy in minutes on Cloudways by DigitalOcean.
- A fancier postMessage tracker with Chrome Manifest version V3 support and a few additional features, inspired by Frans Rosens postmessageβ¦β133Sep 12, 2025Updated last year
- Spec-driven bug bounty writeups and real world security failures.β43Sep 18, 2026Updated 3 weeks ago
- HackerOne Notifier is an automated bot that monitors new programs launched on HackerOne and sends Telegram Bot notifications whenever a nβ¦β22Nov 4, 2025Updated 11 months ago
- Archive Alchemist is a tool for creating specially crafted archives to test extraction vulnerabilities.β242Jul 24, 2025Updated last year
- β11Sep 7, 2023Updated 3 years ago
- Argus is used to test for Blind XSS and SSRF vulnerbilities or any sort of OOB detectionβ15Nov 1, 2024Updated last year
- π CVE Monitor v1.0β28Jun 30, 2025Updated last year
- β52Apr 30, 2026Updated 5 months ago
- A resources for who want to learn and get deep into client-side bugsβ560Dec 8, 2024Updated last year
- Deploy on Railway without the complexity - Free Credits Offer β’ AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Enhanced Burp Suite extension for finding links and sensitive data in JavaScript filesβ26May 10, 2026Updated 5 months ago
- PoC Listβ10Sep 4, 2022Updated 4 years ago
- β15Oct 30, 2022Updated 3 years ago
- 8 Week course to transition from Web/API/Cloud Hacker to AI Red Teamβ36Nov 17, 2025Updated 10 months ago
- β314Updated this week
- Burp Extension to find potential endpoints, parameters, and generate a custom target wordlistβ32Jan 6, 2026Updated 9 months ago
- Keep track of changes in website with WEBSYβ35May 22, 2023Updated 3 years ago
- Tool to parse subdomains from dmarc.liveβ155Apr 19, 2024Updated 2 years ago
- Authenticated SSRF in Grafanaβ83Jun 24, 2024Updated 2 years ago
- Proton VPN Special Offer - Get 70% off β’ AdSpecial partner offer. Trusted by over 100 million users worldwide. Tested, Approved and Recommended by Experts.
- Automatic Enumeration is a command line utility that automatically tries to collect and retrieve various pieces of information from a tarβ¦β15Apr 21, 2025Updated last year
- BetterBugBounty - Here tools are classic, bugs are hunted, and nostalgia is the ultimate weapon!β30Feb 10, 2024Updated 2 years ago
- PostScript examples useful for attacking Ghostscript.β12Aug 1, 2024Updated 2 years ago
- jxscout superpowers JavaScript analysis for security researchersβ468Apr 12, 2026Updated 6 months ago
- β38Oct 16, 2025Updated 11 months ago
- η³ζοΌδ» δΎζε¦ζΌη€ΊοΌη¦η¨ιζ³γζͺζζηθΏθ‘ιι±ΌοΌεζθͺθ΄γβ13May 21, 2024Updated 2 years ago
- Locally scan all the repositories of a github organizationβ35Jul 20, 2025Updated last year
- Tool to perform GCP Domain Wide Delegation abuse and access Gmail and Drive dataβ72Oct 22, 2025Updated 11 months ago
- Script to automate bypassing 403 forbidden status codeβ25Jun 18, 2025Updated last year
- Managed Database hosting by DigitalOcean β’ AdPostgreSQL, MySQL, MongoDB, Kafka, Valkey, and OpenSearch available. Automatically scale up storage and focus on building your apps.
- PoC for XSS in org.webjars:swagger-ui [3.14.2, 3.36.2]β51Feb 17, 2023Updated 3 years ago
- β35Jan 8, 2026Updated 9 months ago
- Things help you get started with Java Vulnerabilityβ74Feb 26, 2023Updated 3 years ago
- β38Jul 4, 2026Updated 3 months ago
- Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting (CVE-2024-29059)β92Mar 25, 2024Updated 2 years ago
- Unofficial MCP server for accessing your HackerOne reports, programs, scope, and earnings from Claude Codeβ40Apr 1, 2026Updated 6 months ago
- β47Jun 7, 2026Updated 4 months ago