1/ Everyone knows HackTricks and PortSwigger. These are the...
Abhishek Meena 🏵️@aacle_
56 views
Jul 18, 2026
~1 min read
Advertisement
1
1/ Everyone knows HackTricks and PortSwigger.
These are the resources that actually find bugs.
Less hyped, higher yield.
A short list I keep going back to. 🧵
These are the resources that actually find bugs.
Less hyped, higher yield.
A short list I keep going back to. 🧵
2
2/ AllAboutBugBounty (daffainfo)
Per-vuln-class notes plus bypass folders (403/429/2FA), tech-specific pages (Jenkins, Grafana, Jira, Laravel), and Google/GitHub/Shodan dork sheets.
Structured the way a hunter thinks: by class, by bypass, by tech.
github.com/daffainfo/AllA…
Per-vuln-class notes plus bypass folders (403/429/2FA), tech-specific pages (Jenkins, Grafana, Jira, Laravel), and Google/GitHub/Shodan dork sheets.
Structured the way a hunter thinks: by class, by bypass, by tech.
github.com/daffainfo/AllA…
3
3/ reconFTW (six2dez)
Automated recon, modular, wires together 50+ tools.
Use it as a baseline pass, or read the config to learn which tools actually matter in 2025.
github.com/six2dez/reconf…
Automated recon, modular, wires together 50+ tools.
Use it as a baseline pass, or read the config to learn which tools actually matter in 2025.
github.com/six2dez/reconf…
4
4/ jsluice (BishopFox)
Extracts URLs and secrets from JS bundles.
The bugs live in the JavaScript almost nobody reads. This tool reads it for you.
github.com/BishopFox/jslu…
Extracts URLs and secrets from JS bundles.
The bugs live in the JavaScript almost nobody reads. This tool reads it for you.
github.com/BishopFox/jslu…
5
5/ waymore (xnl-h4ck3r)
Pulls archived URLs and JS from Wayback.
Production endpoints get removed.
The Wayback copy doesn't. Compare current JS to 6-month-old JS. Deleted endpoints often still resolve.
github.com/xnl-h4ck3r/way…
Pulls archived URLs and JS from Wayback.
Production endpoints get removed.
The Wayback copy doesn't. Compare current JS to 6-month-old JS. Deleted endpoints often still resolve.
github.com/xnl-h4ck3r/way…
6
6/ clairvoyance
GraphQL introspection disabled? This brute-forces the schema from error messages.
Most hunters quit at "introspection off." This one keeps going.
github.com/nikitastupin/c…
GraphQL introspection disabled? This brute-forces the schema from error messages.
Most hunters quit at "introspection off." This one keeps going.
github.com/nikitastupin/c…
7
7/ The one that pays more than any tool: read 10 paid, disclosed HackerOne reports per vuln class before hunting that class.
Not tutorials. Reports. You learn what "impact" looks like to a triager.
Not tutorials. Reports. You learn what "impact" looks like to a triager.
8
Bookmark the ones you'll use. Drop your under-the-radar one below, always looking for more.
