open-sesame

open-sesame Contains hackerone disclosed reports and other bug bounty writeups. A python tool which runs to display random publicly disclosed Hackerone reports when bored. Automatically opens the report in browser. Contains Over 8k Publicly disclosed Hackerone reports and addtl. wordlist of 700 b...

Shockwave-OSS

BountyTricks Sharing Bug Bounty tips and tricks with the community including but not limited to automation, one liners and useful thoughts Cyllabus 💂‍♂️ Misc Regex Validator Homograph Generator Shodan-Scripts HTTP Headers MIME Types Reverse-Proxies Writeups HTTP Request Smuggling Github local recon...

OPENSUSE-SU-2026:12261-1 git-bug-0.11.0-3.1 on GA media

These are all security issues fixed in the git-bug-0.11.0-3.1 package on the GA media of openSUSE Tumbleweed...

Web3Bugs

Demystifying Exploitable Bugs in Smart Contracts This project aims to provide a valuable resource for Web3 developers and security analysts by facilitating their understanding of exploitable bugs in smart contracts. We conduct a thorough analysis of exploitable bugs extracted from code4rena and...

SUSE CVE-2026-99066

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

domato

Domato 🍅 A DOM fuzzer Written and maintained by Ivan Fratric, [email protected] Copyright 2017 Google Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 the "License"; you may not use this file except in compliance with the License. You may obtain a copy of the License ...

domained

domained archived A domain name enumeration tool This project is no longer maintained. Thank you to @ccsplit and @mzfr for their work on domained. Gist: Some terrible continually updated python code leveraging some awesome tools that I use for bug bounty reconnaissance. The tools contained in...

CVE-2026-99066

The Linux kernel contains a vulnerability in the CAN (Controller Area Network) subsystem related to how skb headers are initialized. Specifically, commit 9f10374bb024 removed necessary calls to skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() within init_can_sk...

EUVD-2026-108732

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-98965 ice: Restore Ordered MMIO Writes for Tx Doorbells

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql-numqueued, is updated by the ICE driver when it invokes netdevtxsentqueue...

CVE-2026-98872

The Linux kernel contains a vulnerability in the freevxfs file system where the vxfs_bmap_typed() function calls BUG() when encountering an unknown typed-extent type. This can cause a kernel crash when processing an on-disk typed extent with an unexpected value. The flaw is reachable via the ioct...

CVE-2026-98872

In the Linux kernel, the following vulnerability has been resolved: freevxfs: don't BUG on unknown typed-extent type vxfsbmaptyped handles four typed-extent types and calls BUG in its default case, so an on-disk typed extent with any other type value crashes the kernel. It is reachable from...

reternal-quickstart

RE:TERNAL Note: Still under development, only use for testing and do not expose interfaces! Current compose doesn't work yet, only try when you know what you're doing RE:TERNAL is a centralised purple team orchestration service to manage third-party C2 frameworks. Agents are installed on endpoint...

socialhunter

socialhunter !IMPORTANT This tool is no longer working, and we won't be able to fix it as it has become difficult to bypass social media protections. Crawls the given URL and finds broken social media links that can be hijacked. Broken social links may allow an attacker to conduct phishing attack...

probable_subdomains

Probable subdomains Online tool: https://weakpass.com/generate/domains TL;DR During bug bounties, penetrations tests, red teams exercises, and other great activities, there is always a room when you need to launch amass, subfinder, sublister, or any other tool to find subdomains you can use to...

nodesub

NODESUB Nodesub is a command-line tool for finding subdomains in bug bounty programs. It supports various subdomain enumeration techniques and provides flexible options for customization. Features Perform subdomain enumeration using CIDR notation Support input list. Perform subdomain enumeration...

bug-bounty-domains

BUG BOUNTY DOMAINS Domains belonging to the most reputed public bug bounty programs. NOT FOR NON-MONETARY OR PRIVATE PROGRAMS !https://assets.kitploit.com/production/public/readmes/6941/7164554a880fd0545e5dc196593b59979d6603d1462460...

kenzer

KENZER - Automated web assets enumeration & scanning DEPRECATED Mentions A Conceptual Introduction to Automating Bug Bounties Demo Screenshots Instructions for running 0. Run git clone https://github.com/ARPSyndicate/kenzer /home/ubuntu/kenzer && cd /home/ubuntu/kenzer preferred 1. Create an...

How bug bounty sharpens one researcher’s security skills

As Cybersecurity Awareness Month continues, the GitHub Bug Bounty team is excited to spotlight another top-performing security researcher from the GitHub Security Bug Bounty Program: @r31n ! As home to the world's developers, GitHub is dedicated to the security and reliability of the code behind...

Injectus

Injectus Simple python tool that goes through a list of URLs trying CRLF and open redirect payloads. ▪ ▐ ▄ ▐▄▄▄▄▄▄ . ▄▄· ▄▄▄▄▄▄• ▄▌.▄▄ · ██ •█▌▐█ ·██▀▄.▀·▐█ ▌▪•██ █▪██▌▐█ ▀. ▐█·▐█▐▐▌▪▄ ██▐▀▀▪▄██ ▄▄ ▐█.▪█▌▐█▌▄▀▀▀█▄ ▐█▌██▐█▌▐▌▐█▌▐█▄▄▌▐███▌ ▐█▌·▐█▄█▌▐█▄▪▐█ ▀▀▀▀▀ █▪ ▀▀▀• ▀▀▀ ·▀▀▀ ▀▀▀ ▀▀▀ ▀▀▀▀...