Based on Sean Roesner's bug bounty methodology (bugbountyhunter.com), combined with drew's personal notes.

• Philosophy & Core Principles
• Toolkit & Setup
• Picking a Program
• Recon & Expanding Attack Surface
• Feature Testing Checklist
• XSS Testing
• CSRF Testing
• Open Redirects
• SSRF Testing
• File Upload Testing
• IDOR Testing
• SQL Injection
• CORS Misconfiguration
• Auth & Session Bugs
• Business Logic & Privilege Escalation
• Bug Chaining & Escalation
• Writing Good Reports

• TBHM Index
• Wiki Home