> For the complete documentation index, see [llms.txt](https://notes.programmersecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.programmersecurity.com/bug-bounty/bug-bounty-methodology.md).

# Bug Bounty Methodology

## VPS Automation (using Screens)

While Doing Bug Bounty There are alot of tasks which we need to automate and they take alot of time so we need to keep them running while we exit from the VPS. For this Purpose we have **Screens** which i use most of the times

### Make a New Screen

```
screen -S new-screen-name

e.g

screen -S programmerboy
```

<figure><img src="/files/YC1iVWsmxugC5uqp4AOg" alt=""><figcaption></figcaption></figure>

now you will have a new terminal and that will be your screen terminal

### Detaching the Screen&#x20;

```
CTRL + A + D
```

<figure><img src="/files/bMeMQx4G5JDKSeZ8zBtb" alt=""><figcaption></figcaption></figure>

### List the Screens

```
screen -ls
```

<figure><img src="/files/D1zyeMfDDhXDLA4mA2je" alt=""><figcaption></figcaption></figure>

### Get Back to Screen

```
screen -r programmerboy
```

<figure><img src="/files/HtMHiPPkGZIMud3C9yll" alt=""><figcaption><p>after this you will be back in your screen</p></figcaption></figure>

## TMUX Usage

We can also use TMUX and that is very useful for bug bounty because we our processes can be running in the backend

```python
tmux new -s <Session-name> # Make a new Session

tmux ls  # List the sessions

tmux attach -t <Session-name> # attach to the session 

tmux source-file ~/.tmux.conf # after making changes to tmux.conf file

# Prefix Key is CTRL+B

preix key + d  # detach the from tmux

prefix key + c # Create a new windows

prefix key + <number of windows>  # move to that window

Prefix Key + ,  # Rename the window

prefix key + [  # Enter Copy Mode

prefix key + % # Split Screen vertically

prefix key + " # Split Screen Horizontally





```

## Subdomains

### Amass

```python
amass enum -brute -active -d domain.com -o amass-output.txt
```

### Assetfinder

```
assetfinder --subs-only domain.com
```

### SubFinder

```
subfinder -d domain.com -all
```

### Gau&#x20;

```
gau --threads 5 --subs example.com |  unfurl -u domains | sort -u -o output_unfurl.txt
```

### Waybackurls

```
waybackurls example.com |  unfurl -u domains | sort -u -o output.txt
```

## Discover the IP Range

Visit this website to find the ip ranges

{% embed url="<https://bgp.he.net/>" %}

<figure><img src="/files/qc9Ps0CxWK66wzThmCru" alt=""><figcaption></figcaption></figure>

## Alive Subdomains

### HTTPX

```
cat domains.txt | httpx -title -wc -sc -cl -ct -location -web-server -asn -o alive-subdomains.txt 
```

## Finding JS Files From a Domain

I always find for the Javascript files whenever i am given a domain and i use a tool called GolinkFinder

{% embed url="<https://github.com/0xsha/GoLinkFinder>" %}

```python
GoLinkFinder -d https://domain.com 
```

<figure><img src="/files/HgfqVKwr5JbMNZAWVejG" alt=""><figcaption></figcaption></figure>

## Nuclei

### Nuclei Basic Command

```
nuclei -target 10.10.161.39
```

<figure><img src="/files/D1QKJmhrKrz1CPbWv0dj" alt=""><figcaption></figcaption></figure>

### Nuclei with Specific template

```
nuclei -target 10.10.161.39 -t CVE-2024-57727.yaml
```

<figure><img src="/files/803kIKb2J2IXAYFyMBGo" alt=""><figcaption></figcaption></figure>

#### Nuclei with list of domains

```
nuclei -l targets.txt -o nuclei_results.txt
```

#### Nuclei Stealth Scan

```python
nuclei -l domains.txt -tags cve,misconfig,takeover -severity critical,high -rl 50 -c 10 -no-interactsh -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -o nuclei_results.txt
```