Bug Bounty Methodology Checklist for Web Applications (B2B Apps)

Thexssrat

3 min read

·

Dec 4, 2024

--

Listen

Share

Press enter or click to view image in full size

1. Reconnaissance & Initial Enumeration

• Subdomain Enumeration:
• Use tools like Sublist3r, Amass, and Assetfinder.
• Test discovered subdomains for HTTP/HTTPS access (httpx, httprobe).
• Check for wildcard DNS using dig or nslookup.
• Web Server Fingerprinting:
• Identify web servers (e.g., Nginx, Apache) using WhatWeb or Wappalyzer.
• Analyze technologies and frameworks in use (React, Angular, Ruby on Rails).
• Enumerate Endpoints:
• Use FFUF or Dirbuster for directory brute-forcing with custom wordlists.
• Focus on hidden endpoints (robots.txt, .well-known/, backups, logs).
• Manually explore web functionality for unconventional endpoints.
• Review Metadata:
• Inspect headers for sensitive data (Burp Suite, browser dev tools).
• Analyze JavaScript files for exposed credentials, API endpoints, or logic.

2. Authentication and Session Management

• Username Enumeration:
• Test login forms and password reset…