๐ A list of writeups from the MSRC (Microsoft) Bug Bounty program
โ36Oct 29, 2025Updated 9 months ago
Alternatives and similar repositories for awesome-msrc-writeups
Users that are interested in awesome-msrc-writeups are comparing it to the libraries listed below. We may earn a commission when you buy through links labeled 'Ad' on this page.
Sorting:
- A BugBounty playbook covering vulnerability bypasses, payloads, and quick checks for OWASP Top 10 + extras.โ23Sep 29, 2025Updated 10 months ago
- JSSCM detects expired domains for Stored XSS exploitation during browsing.โ57Apr 3, 2025Updated last year
- web app monitoring automationโ15Jan 7, 2025Updated last year
- A collection of ctf 'web-pwn' challenges, which require the exploitation of memory-related vulnerabilities within essential web componentโฆโ16Oct 2, 2024Updated last year
- A fancier postMessage tracker with Chrome Manifest version V3 support and a few additional features, inspired by Frans Rosens postmessageโฆโ130Sep 12, 2025Updated 11 months ago
- Deploy on Railway without the complexity - Free Credits Offer โข AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Spec-driven bug bounty writeups and real world security failures.โ42Jul 5, 2026Updated last month
- HackerOne Notifier is an automated bot that monitors new programs launched on HackerOne and sends Telegram Bot notifications whenever a nโฆโ22Nov 4, 2025Updated 9 months ago
- Archive Alchemist is a tool for creating specially crafted archives to test extraction vulnerabilities.โ240Jul 24, 2025Updated last year
- โ11Sep 7, 2023Updated 2 years ago
- Argus is used to test for Blind XSS and SSRF vulnerbilities or any sort of OOB detectionโ14Nov 1, 2024Updated last year
- ๐ CVE Monitor v1.0โ27Jun 30, 2025Updated last year
- โ51Apr 30, 2026Updated 3 months ago
- A resources for who want to learn and get deep into client-side bugsโ554Dec 8, 2024Updated last year
- ้ ๅ CVE-2023-22515 ๅๅฐไธไผ jarๅ ๅฎ็ฐRCEโ23Nov 9, 2023Updated 2 years ago
- Managed Kubernetes at scale on DigitalOcean โข AdDigitalOcean Kubernetes includes the control plane, bandwidth allowance, container registry, automatic updates, and more for free.
- PoC Listโ10Sep 4, 2022Updated 3 years ago
- Enhanced Burp Suite extension for finding links and sensitive data in JavaScript filesโ26May 10, 2026Updated 3 months ago
- 8 Week course to transition from Web/API/Cloud Hacker to AI Red Teamโ32Nov 17, 2025Updated 8 months ago
- Burp Extension to find potential endpoints, parameters, and generate a custom target wordlistโ31Jan 6, 2026Updated 7 months ago
- Tool to parse subdomains from dmarc.liveโ154Apr 19, 2024Updated 2 years ago
- Keep track of changes in website with WEBSYโ35May 22, 2023Updated 3 years ago
- Authenticated SSRF in Grafanaโ83Jun 24, 2024Updated 2 years ago
- Automatic Enumeration is a command line utility that automatically tries to collect and retrieve various pieces of information from a tarโฆโ15Apr 21, 2025Updated last year
- BetterBugBounty - Here tools are classic, bugs are hunted, and nostalgia is the ultimate weapon!โ30Feb 10, 2024Updated 2 years ago
- Deploy on Railway without the complexity - Free Credits Offer โข AdConnect your repo and Railway handles the rest with instant previews. Quickly provision container image services, databases, and storage volumes.
- Independent file type identification python libraryโ12Mar 16, 2023Updated 3 years ago
- PostScript examples useful for attacking Ghostscript.โ12Aug 1, 2024Updated 2 years ago
- jxscout superpowers JavaScript analysis for security researchersโ473Apr 12, 2026Updated 4 months ago
- ็ณๆ๏ผไป ไพๆๅญฆๆผ็คบ๏ผ็ฆ็จ้ๆณใๆชๆๆ็ญ่ฟ่ก้้ฑผ๏ผๅๆ่ช่ดใโ12May 21, 2024Updated 2 years ago
- Locally scan all the repositories of a github organizationโ35Jul 20, 2025Updated last year
- Script to automate bypassing 403 forbidden status codeโ26Jun 18, 2025Updated last year
- PoC for XSS in org.webjars:swagger-ui [3.14.2, 3.36.2]โ51Feb 17, 2023Updated 3 years ago
- โ35Jan 8, 2026Updated 7 months ago
- โ38Jul 4, 2026Updated last month
- GPU virtual machines on DigitalOcean Gradient AI โข AdGet to production fast with high-performance AMD and NVIDIA GPUs you can spin up in seconds. The definition of operational simplicity.
- Additional resources for leaking and exploiting ObjRefs via HTTP .NET Remoting (CVE-2024-29059)โ92Mar 25, 2024Updated 2 years ago
- โ1,171Jan 28, 2026Updated 6 months ago
- โ45Jun 7, 2026Updated 2 months ago
- Unofficial MCP server for accessing your HackerOne reports, programs, scope, and earnings from Claude Codeโ40Apr 1, 2026Updated 4 months ago
- Low-level HTTP/2 client implementation for experimenting with the protocol.โ12Jul 26, 2020Updated 6 years ago
- JAW: A Graph-based Security Analysis Framework for Client-side JavaScriptโ118Feb 13, 2026Updated 5 months ago
- The fastest way to setup XSSHunter. It has options for the official and Discord/Slack Forksโ46Mar 2, 2024Updated 2 years ago