Bug Bounty Checklist for Web App

This checklist may help you to have a good methodology for bug bounty hunting
When you have done a action, don't forget to check ;)
Happy hunting !

Table of Contents

• Recon on wildcard domain
• Single domain
• Information Gathering
• Configuration Management
• Secure Transmission
• Authentication
• Session Management
• Authorization
• Data Validation
• Denial of Service

Recon on wildcard domain

1.  Run amass
2.  Run subfinder
3.  Run assetfinder
4.  Run dnsgen
5.  Run massdns
6.  Use httprobe
7.  Run aquatone (screenshot for alive host)

Single Domain

Scanning

1.  Run amass
2.  Nmap scan
3.  Burp Crawler
4.  FFUF --Directory & File fuzzing
5.  Hakrawler / gau / paramspider
6.  Linkfinder
7.  Url with android application

Manual Checking

1.  Shodan
2.  Censys
3.  Google Dork
4.  Pastbin
5.  Github
6.  OSING

Information Gathering

1.  Manually explore the site
2.  Spider/crawl for missed or hidden content
3.  Check for files that expose content, Ex: sitemap.xml
4.  Check the caches of major search engines for publicly accessible sites
5.  Check for differences in content based on User Agent (e.g., Mobile sites, access as a Search engine Crawler)
6.  Perform Web Application Fingerprinting
7.  Identify technologies used
8.  Identify user roles
9.  Identify application entry points
10.  Identify client-side code
11.  Identify multiple versions/channels (e.g., web, mobile web, mobile app, web services)
12.  Identify co-hosted and related applications
13.  Identify all hostnames and ports
14.  Identify third-party hosted content
15.  Identify Debug parameters

Configuration Management

1.  Check for commonly used application and administrative URLs
2.  Check for old, backup and unreferenced files
3.  Check HTTP methods supported and Cross Site Tracing (XST)
4.  Test file extensions handling
5.  Test for security HTTP headers (e.g. CSP, X-Frame-Options, HSTS)
6.  Test for policies (e.g. Flash, Silverlight, robots)
7.  Test for non-production data in live environment, and vice-versa
8.  Check for sensitive data in client-side code (e.g. API keys, credentials)

Secure Transmission

1.  Check SSL Version, Algorithms, Key length
2.  Check for Digital Certificate Validity (Duration, Signature and CN)
3.  Check credentials only delivered over HTTPS
4.  Check that the login form is delivered over HTTPS
5.  Check session tokens only delivered over HTTPS
6.  Check if HTTP Strict Transport Security (HSTS) in use

Authentication

1.  Test for user enumeration
2.  Test for authentication bypass
3.  Test for bruteforce protection
4.  Test password quality rules
5.  Test remember me functionality
6.  Test for autocomplete on password forms/input
7.  Test password reset and/or recovery
8.  Test password change process
9.  Test CAPTCHA
10.  Test multi factor authentication
11.  Test for logout functionality presence
12.  Test for cache management on HTTP (eg Pragma, Expires, Max-age)
13.  Test for default logins
14.  Test for user-accessible authentication history
15.  Test for out-of channel notification of account lockouts and successful password changes
16.  Test for consistent authentication across applications with shared authentication schema / SSO

Session Management

1.  Establish how session management is handled in the application (eg, tokens in cookies, token in URL)
2.  Check session tokens for cookie flags (httpOnly and secure)
3.  Check session cookie scope (path and domain)
4.  Check session cookie duration (expires and max-age)
5. Check session termination after a maximum lifetime
6. Check session termination after relative timeout
7. Check session termination after logout
8. Test to see if users can have multiple simultaneous sessions
9. Test session cookies for randomness
10. Confirm that new session tokens are issued on login, role change and logout

Authorization

1.  Test for path traversal
2.  Test for bypassing authorization schema
3.  Test for vertical Access control problems (a.k.a. Privilege Escalation)
4.  Test for horizontal Access control problems (between two users at the same privilege level)
5.  Test for missing authorization

Data Validation

1.  Test for Reflected Cross Site Scripting
2.  Test for Stored Cross Site Scripting
3.  Test for DOM based Cross Site Scripting
4.  Test for Cross Site Flashing
5.  Test for HTML Injection
6.  Test for SQL Injection
7.  Test for LDAP Injection
8.  Test for ORM Injection
9.  Test for XML Injection
10.  Test for XXE Injection
11.  Test for SSI Injection
12.  Test for XPath Injection
13.  Test for XQuery Injection
14.  Test for IMAP/SMTP Injection
15.  Test for Code-Injection
16. Expression Language Injection
17. Command Injection
18. Overflow (Stack, Heap and Integer)
19. Format String
20. Incubated vulnerabilities
21. HTTP Splitting/Smuggling
22. HTTP Verb Tampering
23. Open Redirection
24. Local File Inclusion
25. Remote File Inclusion
26. Compare client-side and server-side validation rules
27. NoSQL injection
28. HTTP parameter pollution
29. Auto-binding
30. Mass Assignment

Denial of Service

1. Anti-automation
2. Account lockout
3. HTTP protocol DoS
4. SQL wildcard DoS