{"id":13842044,"url":"https://github.com/Virdoexhunter/CheckLists","last_synced_at":"2025-07-11T13:33:30.560Z","repository":{"id":41109395,"uuid":"287450189","full_name":"Virdoexhunter/CheckLists","owner":"Virdoexhunter","description":null,"archived":false,"fork":false,"pushed_at":"2020-08-15T05:16:31.000Z","size":6,"stargazers_count":31,"open_issues_count":0,"forks_count":10,"subscribers_count":1,"default_branch":"master","last_synced_at":"2024-08-05T17:30:19.174Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Virdoexhunter.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-08-14T05:20:05.000Z","updated_at":"2024-01-15T17:43:21.000Z","dependencies_parsed_at":"2022-09-09T05:40:45.048Z","dependency_job_id":null,"html_url":"https://github.com/Virdoexhunter/CheckLists","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Virdoexhunter%2FCheckLists","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Virdoexhunter%2FCheckLists/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Virdoexhunter%2FCheckLists/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Virdoexhunter%2FCheckLists/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Virdoexhunter","download_url":"https://codeload.github.com/Virdoexhunter/CheckLists/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225729814,"owners_count":17515171,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:01:26.512Z","updated_at":"2024-11-21T12:30:47.066Z","avatar_url":"https://github.com/Virdoexhunter.png","language":null,"funding_links":[],"categories":["Others (1002)","Others"],"sub_categories":[],"readme":"# BugBounty CheckLists\n\nRecon -\u003e Recon Checklists\n\n1-Subdomain Enumeration -\u003e done using subfinder and get all alive domains and their status code:)\n2-Subdomain Takeovers\n3-Misconfigured Third Party Services\n4-Misconfigured Storage Options (S3 Buckets)\n5-Broken Link Hijacking\n6-Directory Enumeration\n7-Service Enumeration\n8-JS Files for Domains, Sensitive Information such as Hardcoded APIs \u0026 Secrets\n9-GitHub Recon\n10-Parameter Discovery\n11-Wayback History \u0026 Waybackurls\n12-Google Dork for Increasing Attack Surface\n13-Internet Search Engine Discovery (Shodan, Censys, Fofa, BinaryEdge, Spyse, Etc.)\n14-Potential URL Extraction for Vulnerability Automation (GF Patterns + Automation Scripts\n\nVulnerability Checklists\n\n1-Old Session Does Not expire -\u003e  grab all login and signup functionality\n2-Password Reset Token Leakage -\u003e Check for password reset token leakage\n3-Password reset token leakage      \n4-Session Hijacking\n5-CSRF all types\n6-OAuth Token Leakage\n7-HTML Injection\n8-XSS\n9-Email Change\n10-IDOR\n11-Parameter Tampring\n12-SSRF\n13-CVES\n14-Other Service exploits\n15-Host Header Injection\n16-Open Redirects\n17-Web Cache Poisoning\n18-CSRF token not expired\n19-Rate Limits(bypass)\n20-2FA bypass\n21-Concurrent Issues\n\nGithub Dorks To Look For:\n1- filename:.bash_history DOMAIN-NAME\n2- SECRET_KEY_BASE=\n3- \"stie.com\" vim_settings.xml\n4-  Wordpress_DB_PASSWORD\n5- filename: wp-config.php\n\nList of github dorks\napi_key\n“api keys”\nauthorization_bearer:\noauth\nauth\nauthentication\nclient_secret\napi_token:\n“api token”\nclient_id\npassword\nuser_password\nuser_pass\npasscode\nclient_secret\nsecret\npassword hash\nOTP\nuser auth\n\nXSS_JSON :\n1- \"}]}';alert('oBonito')\u003c/script\u003e\n\nCSRF BYPASS:\n\n1-Change POST to GET\n2-Remove Total Token Parameter\n3-Blank\n4-Replace random value with same length\n5-change Content-Type:form/multipart\n\n\nGoogle Dorks:\n1-inurl:site.com intitle:\"index of\"\n2-inurl:site.com intitle:\"index of /\" \"*key.pem\"\n3-inurl:site.com ext:sql|ext:bak|ext:old|ext:env|ext:xls|ext:xml|ext:json|ext:csv|ext:yml\n4-inurl:site.com \"MYSQL_ROOT_PASSWORD\"\n\n---------------------------------------------------------------------BEST TWEETS---------------------------------------------------------------------------------------\n\nJS FILES LOOKUP:\nhttps://twitter.com/Haoneses/status/1291387580299321358/photo/1\n\nBroken Link Hijacking:\nhttps://twitter.com/micha3lb3n/status/1289939398797037568/photo/1\n\nADMIN PORTAL BYPASS CHECK:\nhttps://twitter.com/SalahHasoneh1/status/1287825026134269958/photo/1\n\nACCOUNT TAKEOVER:\nhttps://twitter.com/Muhe76355002/status/1287250650028482562/photo/1\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FVirdoexhunter%2FCheckLists","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FVirdoexhunter%2FCheckLists","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FVirdoexhunter%2FCheckLists/lists"}