Cybersecurity

05_xss - fix // in inline code breaking italic parser

drew (drew@undisclosed.example.com) — 2026-05-14T09:42:21+00:00

Tactical Fuzzing - XSS XSS Core Idea: Does the page functionality display something to the users? For time sensitive testing the 80/20 rule applies. Many testers use Polyglot payloads. You probably have too! Multi-context, filter bypass based polyglot payload #1 (Rsnake XSS Cheat Sheet)

start

drew (drew@undisclosed.example.com) — 2026-05-14T09:33:20+00:00

Wiki Welcome to the knowledge base. TBHM Chapters * 01 - Philosophy & Mindset * 02 - Discovery & Recon * 03 - Mapping the Attack Surface * 04 - Authorization & Session Management * 05 - Cross-Site Scripting (XSS) * 06 - SQL Injection * 07 - File Upload Vulnerabilities * 08 - CSRF * 09 - Privilege Escalation, Logic & Transport * 10 - Mobile Testing * 11 - Auxiliary Info & Tools * 12 - IDOR * Fast Testing Checklist Quick Reference * TBHM Index * Fast Checklist *…

02_discovery - merge bbc ch5 recon techniques

drew (drew@undisclosed.example.com) — 2026-05-14T09:11:30+00:00

Discovery Find the road less traveled This means find the application (or parts of an application) less tested. In wide scoped projects the flagship application will most liekly be heavily assessed. * ^.acme.com scope is your friend * Find domains via Google (and others!)

04_env_setup - bbc article -- updated with full content

drew (drew@undisclosed.example.com) — 2026-05-14T09:11:30+00:00

Ch 4: Environmental Setup and Traffic Interception Source: Bug Bounty Bootcamp by Vickie Li (No Starch Press, 2021) OS Use a Unix-based system. Kali Linux is recommended -- it ships with Burp Suite, Gobuster, DirBuster, Wfuzz, and other tools. macOS also works fine.

03_how_internet_works - bbc article -- updated with full content

drew (drew@undisclosed.example.com) — 2026-05-14T09:11:30+00:00

Ch 3: How the Internet Works Source: Bug Bounty Bootcamp by Vickie Li (No Starch Press, 2021) Client-Server Model Web apps operate on a client-server model. The client (browser) sends HTTP requests; the server processes them and returns responses.

02_sustaining_success - bbc article from bug bounty bootcamp

drew (drew@undisclosed.example.com) — 2026-05-14T09:05:08+00:00

Ch 2: Sustaining Your Success Source: Bug Bounty Bootcamp by Vickie Li (No Starch Press, 2021) Writing Good Reports A report is how you get paid and build reputation. Bad writing = low payouts + duplicates marked invalid. 8-step report structure:

01_picking_program - bbc article from bug bounty bootcamp

drew (drew@undisclosed.example.com) — 2026-05-14T09:05:08+00:00

Ch 1: Picking a Bug Bounty Program Source: Bug Bounty Bootcamp by Vickie Li (No Starch Press, 2021) Asset Types Bug bounty programs define scope by listing assets -- the systems you are authorized to test. * Social targets -- Twitter/Facebook/LinkedIn pages. Usually out-of-scope because you can't control what users post.

all_articles - create full article index

drew (drew@undisclosed.example.com) — 2026-05-14T09:00:05+00:00

All Articles Complete index of every page on this wiki. The Bug Hunter's Methodology (TBHM) * 01 - Philosophy & Mindset * 02 - Discovery & Recon * 03 - Mapping the Attack Surface * 04 - Authorization & Session * 05 - Cross-Site Scripting (XSS) * 06 - SQL Injection * 07 - File Upload * 08 - CSRF * 09 - Privilege, Logic & Transport * 10 - Mobile Testing * 11 - Auxiliary Info & Tools * 12 - IDOR * Fast Testing Checklist * TBHM Index * Test Page * TBHM v4 Zseano's…

12_idor - integrate zseano methodology

drew (drew@undisclosed.example.com) — 2026-05-14T08:59:18+00:00

Insecure Direct Object References IDOR Overview To be continued... Zseano IDOR Additions * Try integers even when you see GUIDs -- server may accept both formats * Inject “id”:“1” into JSON POST bodies even when not normally present *

04_authorization - integrate zseano methodology

drew (drew@undisclosed.example.com) — 2026-05-14T08:59:17+00:00

Auth and Session Auth (better be quick) Auth Related (more in logic, priv, and transport sections) * User/pass discrepancy flaw * Registration page harvesting * Login page harvesting * Password reset page harvesting * No account lockout

06_sqli - integrate zseano methodology

drew (drew@undisclosed.example.com) — 2026-05-14T08:59:17+00:00

Tactical Fuzzing - SQLi SQL Injection Core Idea: Does the page look like it might need to call on stored data? There exist some SQLi polyglots, i.e (Mathias Karlsson): SLEEP(1) /*' or SLEEP(1) or '" or SLEEP(1) or "*/ Works in single quote context, works in double quote context, works in

08_csrf - integrate zseano methodology

drew (drew@undisclosed.example.com) — 2026-05-14T08:59:17+00:00

CSRF Testing Testing CSRF On Application * CSRF Normal * Change Method To GET-Based * Change Value Of CSRF-Token To undefined * Delete CSRF Token Value Or Delete Token Parameter * Use The same CSRF Value In Different Accounts * Replace Value CSRF Token with Same Length Characters

reporting - add zseano methodology article

drew (drew@undisclosed.example.com) — 2026-05-14T08:58:18+00:00

Writing Good Reports A good report is what separates a bounty from a duplicate or a N/A. Good reports build reputation and get private invites. Report Structure Title: [Bug Type] on [Feature/Endpoint] leads to [Impact] Examples: * “Stored XSS in profile bio via unsanitized