Bug Bounty Open Source Projects

A collection of various awesome lists for hackers, pentesters and security researchers

Web path scanner

A list of resources for those interested in getting started in bug bounties

reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.

reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities

The all-in-one browser extension for offensive security professionals 🛠

A Modern Orchestration Engine for Security

A comprehensive curated list of available Bug Bounty & Disclosure Programs and Write-ups.

The dynamic infrastructure framework for everybody! Distribute the workload of many different scanning tools with ease, including nmap, ffuf, masscan, nuclei, meg and many more!

Applied offensive security with Rust - https://kerkour.com/black-hat-rust

A Security Tool for Bug Bounty, Pentest and Red Teaming.

Inspired by https://github.com/djadmin/awesome-bug-bounty, a list of bug bounty write-up that is categorized by the bug nature

GitHub repository for the SecureDrop whistleblower platform. Do not submit tips here!

A collection of awesome one-liner scripts especially for bug bounty tips.

Scan for misconfigured S3 buckets across S3-compatible APIs!

🕵️ OSINT Tools for gathering information and actions forensics 🕵️

Semi-automatic OSINT framework and package manager

This challenge is Inon Shkedy's 31 days API Security Tips.

Collection of quality safety articles. Awesome articles.

DNS Takeover tool written in Go

A tool to find subdomains and interesting things hidden inside, external Javascript files of page, folder, and Github.

A comprehensive guide for web application penetration testing and bug bounty hunting, covering methodologies, tools, and resources for identifying and exploiting vulnerabilities.

Burp Bounty (Scan Check Builder in BApp Store) is a extension of Burp Suite that allows you, in a quick and simple way, to improve the active and passive scanner by means of personalized rules through a very intuitive graphical interface.

OSINT tools and more but without API key

Asset inventory of over 800 public bug bounty programs.

一款信息泄漏利用工具，适用于.git/.svn/.DS_Store泄漏和目录列出

A collection of awesome one-liners for bug bounty hunting.

Obtain GraphQL API schema even if the introspection is disabled

API Security Project aims to present unique attack & defense methods in API Security field

A curated collection of top-tier penetration testing tools and productivity utilities across multiple domains. Join us to explore, contribute, and enhance your hacking toolkit!

🦄 🦄 🦄 Peripheral smart contracts for interacting with Uniswap v3

Community curated list of public bug bounty and responsible disclosure programs.

An automation tool that enumerates subdomains then filters out xss, sqli, open redirect, lfi, ssrf and rce parameters and then scans for vulnerabilities.

Automation for javascript recon in bug bounty.

🔨 List all IP ranges from: Google (Cloud & GoogleBot), Bing (Bingbot), Amazon (AWS), Microsoft, Oracle (Cloud), GitHub, Facebook (Meta), OpenAI (GPTBot) and other with daily updates.

Open-source vulnerability disclosure and bug bounty program database

Sublert is a security and reconnaissance tool which leverages certificate transparency to automatically monitor new subdomains deployed by specific organizations and issued TLS/SSL certificate.

The most exhaustive list of reliable DNS resolvers.

A Powerful Subdomain Takeover Tool

Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AI‑assisted summaries, it delivers faster, more structured, and high‑quality security assessments.

My collection of various security tools created mostly in Python and Bash. For CTFs and Bug Bounty.

A cross-platform note-taking & target-tracking app for penetration testers.

Quickly Extracts IP's, Email Addresses, Hashes, Files, Credit Cards, Social Security Numbers and a lot More From Text

Live validation proxy tool for testing web app vulnerabilities

A tool to link a domain with registered organisation names and emails, to other domains.

Collection of Facebook Bug Bounty Writeups

Work in progress...

🎯 XML External Entity (XXE) Injection Payload List

crawls the website and finds broken social media links that can be hijacked

Offensive Docker is an image with the more used offensive tools to create an environment easily and quickly to launch assessment to the targets.

A vulnerable Android application that shows simple examples of vulnerabilities in a ctf style.

Security Mindmap that could be useful for the infosec community when doing pentest, bug bounty or red-team assessments.

A command-line utility designed to discover URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly available.

Vajra is a highly customizable target and scope based automated web hacking framework to automate boring recon tasks and same scans for multiple target during web applications penetration testing.

ScanT3r - Module based Bug Bounty Automation Tool

Yet another tool to dump a git repository from a website, focused on as-complete-as-possible dumps and handling weird edge-cases.

Bug Bounty ~ Awesomes | Books | Cheatsheets | Checklists | Tools | Wordlists | More

Simple python script supported with BurpBouty profile that helps you to detect SQL injection "Error based" by sending multiple requests with 14 payloads and checking for 152 regex patterns for different databases.

My subdomain enumeration script. It's unique in the way it is built upon.

RevSuit is a flexible and powerful reverse connection platform designed for receiving connection from target host in penetration.