Bounty Open Source Projects

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Source code for Hacker101.com - a free online web and mobile security class.

Fast passive subdomain enumeration tool.

A list of resources for those interested in getting started in bug bounties

A handy guide to financial support for open source

Keyhacks is a repository which shows quick ways in which API keys leaked by a bug bounty program can be checked to see if they're valid.

A comprehensive curated list of available Bug Bounty & Disclosure Programs and Write-ups.

Robust, fast, intuitive plain text accounting tool with CLI, TUI and web interfaces.

Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

This repo contains hourly-updated data dumps of bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) that are eligible for reports

NEO Smart Economy

EasyHook - The reinvention of Windows API Hooking

A collection of awesome one-liner scripts especially for bug bounty tips.

Vanilla is a powerfully simple discussion forum you can easily customize to make as unique as your community.

Open source education content for the researcher community

ezXSS is an easy way for penetration testers and bug bounty hunters to test (blind) Cross Site Scripting.

Vim key-bindings for Xcode 9

We're tracking all our Issues, RFCs and a few other documents in this repository.

List of Google Dorks for sites that have responsible disclosure program / bug bounty program

Grow Open Source

A tool to view and extract the contents of an Windows Installer (.msi) file.

Bug Bounty Roadmaps

🐛 A list of writeups from the Google VRP Bug Bounty program

Everything for pentest. | 用于渗透测试的 payload 和 bypass 字典.

Microsoft Authentication Library (MSAL) for .NET

Fast GitHub recon tool. Scans for leaked secrets across all of GitHub, not just known repos and orgs. Support for GitHub dorks.

Aave Protocol Version 1.0 - Decentralized Lending Pools

VirtualBox E1000 Guest-to-Host Escape

A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit!

Community curated list of public bug bounty and responsible disclosure programs.

A script to set up a quick Ubuntu 17.10 x64 box with tools I use.

AppSec Ezine Public Repository.

C++14 implementation of the TLS-1.3 standard

A multi-platform bug bounty toolkit that can be installed on Debian/Ubuntu or set up with Docker.

Automation for javascript recon in bug bounty.

Open-source vulnerability disclosure and bug bounty program database

Search Google/Bing/Ecosia/DuckDuckGo/Yandex/Yahoo for a search term (dork) with a default set of websites, bug bounty programs or custom collection.

Thermophysical properties for the masses

Microsoft.Data.SqlClient provides database connectivity to SQL Server for .NET applications.

Payload Arsenal for Pentration Tester and Bug Bounty Hunters

Grow Open Source

A Bash script and Docker image for Bug Bounty reconnaissance. Intended for headless use.

Open Collective's Frontend. A React app powered by Next.js.

Collection of Facebook Bug Bounty Writeups

Javascript and SVG odometer effect library with motion blur

Security Mindmap that could be useful for the infosec community when doing pentest, bug bounty or red-team assessments.

AcDisplay is a new way of handling notifications in Android.

A tool that allows you to convert NMAP results to html, csv, json, markdown, graphviz (dot), sqlite, excel and d2-lang. Simply put it's nmap converter.

This project crawls bug bounty platform scopes (like Hackerone/Bugcrowd/Intigriti/etc) hourly and dumps them into the bounty-targets-data repo

Dragonchain blockchain platform - simplified integration of advanced blockchain features

An Easy / Quick / Cheap Integrated Platform

The Bug Bounty Reconnaissance Framework (BBRF) can help you coordinate your reconnaissance workflows across multiple devices

Node.js Ecosystem Security Working Group

A collection of templates for bug bounty reporting

The New Official Aparapi: a framework for executing native Java and Scala code on the GPU.

Bounty program for CryptoKitties smart contract

Bug Bounty Guide is a launchpad for bug bounty programs and bug bounty hunters.

🎯 Server Side Template Injection Payloads