gabson0x/bountyforge/bug-bounty

# Pick ONE of these and run hunt.py normally:
python3 tools/hunt.py --target T --cookie 'session=eyJabc...'
python3 tools/hunt.py --target T --bearer 'eyJhbGciOi...'
python3 tools/hunt.py --target T --auth-file .private/T.json
 
# Or via env (persists for the shell):
export BBHUNT_COOKIE='session=eyJabc...'
python3 tools/hunt.py --target T

python3 tools/hunt.py --target T --auth-file .private/T-user-a.json
python3 tools/hunt.py --target T --auth-file .private/T-user-b.json
# Audit log entries carry different session_id hashes → diff which
# endpoints behaved differently per identity.

# Mail.tm API (free, no registration, fully programmatic)
create_temp_email() {
  DOMAIN=$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')
  EMAIL="hunter_$(date +%s)@${DOMAIN}"
  PASSWORD="TempPass123!"
  curl -s -X POST https://api.mail.tm/accounts \
    -H "Content-Type: application/json" \
    -d "{\"address\":\"$EMAIL\",\"password\":\"$PASSWORD\"}"
  echo "$EMAIL"
}
 
# Create 3 accounts for comprehensive testing
for i in 1 2 3; do
  EMAIL=$(create_temp_email)
  echo "Account $i: $EMAIL"
done

BEFORE HUNTING:
1. Create temp email #1 → register "attacker" account (low priv)
2. Create temp email #2 → register "victim" account (another user)
3. Create temp email #3 → register additional test account
4. Complete email verification for all accounts
5. Login to all accounts in Burp (different containers/profiles)
 
WHILE HUNTING:
- Test IDOR: Account A requests with Account B's resource IDs
- Test privilege escalation: Account A tries admin endpoints
- Test business logic: Account A manipulates Account B's data
- Test race conditions: Both accounts perform same action simultaneously
- Test auth bypass: Access protected routes without tokens
 
AFTER FINDING A BUG:
- Quantify: "This affects all N users" (use temp email count as proof)
- Chain: Combine low-severity bugs for higher impact
- Document: Which accounts were used, what data was accessed

# Step 1: Create two temp emails
EMAIL_A="hunter_$(date +%s)@$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')"
EMAIL_B="victim_$(date +%s)@$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')"
 
# Step 2: Register both accounts on target
# Account A: attacker (low privilege)
# Account B: victim (another user)
 
# Step 3: Login to both accounts in Burp
# Account A → Burp Container 1
# Account B → Burp Container 2
 
# Step 4: As Account A, perform actions and note all IDs
# Example: GET /api/v1/users/123/orders → order IDs: 456, 789
# Example: GET /api/v1/users/123/profile → user ID: 123
 
# Step 5: As Account A, try to access Account B's resources
# Change user_id in request: /api/v1/users/456/orders
# If Account A can see Account B's orders = IDOR
 
# Step 6: Document the finding
# "Account A (attacker@test.com) can access Account B (victim@test.com)
#  resources by changing user_id parameter from 123 to 456"
# "This affects all users on the platform"

# Step 1: Create temp email for regular user
EMAIL_USER="user_$(date +%s)@$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')"
 
# Step 2: Register as regular user (no admin privileges)
 
# Step 3: Test admin endpoints
# Try accessing admin-only endpoints with regular user token
curl -s -H "Authorization: Bearer $REGULAR_USER_TOKEN" \
  https://target.com/api/admin/users
# If 200 response = privilege escalation
 
# Step 4: Test role manipulation
# In registration or profile update, try adding role parameter
curl -s -X POST https://target.com/api/register \
  -H "Content-Type: application/json" \
  -d '{"email":"user@test.com","password":"pass","role":"admin"}'
# If accepted = mass assignment vulnerability
 
# Step 5: Test admin panel access
# Try accessing /admin, /dashboard, /panel with regular user
curl -s -H "Authorization: Bearer $REGULAR_USER_TOKEN" \
  https://target.com/admin
# If 200 response = admin panel accessible

# Step 1: Create two temp emails for different user types
EMAIL_FREE="free_$(date +%s)@$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')"
EMAIL_PAID="paid_$(date +%s)@$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')"
 
# Step 2: Register free account and paid account
# Free: limited features
# Paid: full access
 
# Step 3: Test as free user trying paid features
# Example: Free user tries to access premium API endpoint
curl -s -H "Authorization: Bearer $FREE_USER_TOKEN" \
  https://target.com/api/premium/data
# If 200 response = business logic bypass
 
# Step 4: Test price manipulation
# Example: Free user tries to purchase at discounted price
curl -s -X POST https://target.com/api/purchase \
  -H "Authorization: Bearer $FREE_USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"item":"premium","price":0}'
# If accepted = price manipulation vulnerability

# Step 1: Create two temp emails
EMAIL_RACE1="race1_$(date +%s)@$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')"
EMAIL_RACE2="race2_$(date +%s)@$(curl -s https://api.mail.tm/domains | jq -r '.[0].domain')"
 
# Step 2: Register both accounts
 
# Step 3: Simultaneous requests from both accounts
# Example: Both accounts try to redeem same coupon
curl -s -X POST https://target.com/api/redeem \
  -H "Authorization: Bearer $RACE1_TOKEN" \
  -d '{"code":"PROMO10"}' &
 
curl -s -X POST https://target.com/api/redeem \
  -H "Authorization: Bearer $RACE2_TOKEN" \
  -d '{"code":"PROMO10"}' &
 
wait
# If both succeed = race condition = double spend

# 1. Register with temp email
# 2. Trigger password reset
# 3. Fetch reset token from temp email API
TOKEN=$(curl -s "https://api.mail.tm/messages" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.[0].text' | grep -oP 'token=\K[^"&]+')
 
# 4. Test: Can you use reset from different IP?
# 5. Test: Does token expire? (request new, try old)
# 6. Test: Can you brute force weak tokens?
# 7. Test: Does reset link leak in Referer header?

# Some sites require email verification before account is active
# Temp emails can fetch verification links programmatically
 
# Mail.tm verification
TOKEN=$(curl -s -X POST https://api.mail.tm/token \
  -H "Content-Type: application/json" \
  -d '{"address":"'$EMAIL'","password":"TempPass123!"}' | jq -r '.token')
 
# Fetch messages
curl -s "https://api.mail.tm/messages" \
  -H "Authorization: Bearer $TOKEN" | jq '.[0].text'
 
# Extract verification link
VERIFY_URL=$(curl -s "https://api.mail.tm/messages" \
  -H "Authorization: Bearer $TOKEN" | jq -r '.[0].text' | grep -oP 'https?://\S+verify\S+')
 
# Visit verification link
curl -s "$VERIFY_URL"