<h1> # One Liner Bug Bounty CheatSheet</h1> <div style="align:center;">

</div>

Why OneLiners?

In the world of bug bounty hunting, time is precious. Short, impactful tips can make all the difference. Here, you'll find quick insights that can easily be referenced when you're diving into a new target, testing a feature, or looking to refine your methodology.

Misconfigurations, Tech Detection, and Common Bugs

If you want wider coverage, like misconfigurations, tech detection, and common bugs, change the template path to -t vulnerabilities/:

cat urls.txt | httpx -silent -mc 200 | nuclei -silent -t vulnerabilities/ -o results.txt

Subdomain Takeovers - Quick Check

Want to check for subdomain takeovers in one line?

subfinder -d example.com | httpx -silent | nuclei -silent -t takeovers/ -o takeover.txt

Subdomain Discovery + Live Check

For subdomain discovery with live check:

subfinder -d target.com | httpx -silent -mc 200

Subdomain Takeover Detection

Detect subdomain takeovers:

subfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/

Directory Bruteforce (Content Discovery)

For directory bruteforce:

ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200

Find Open Redirects (Quick Scan)

To quickly find open redirects:

cat urls.txt | gf redirect | httpx -silent

XSS Detection (Using Dalfox)

For XSS detection using Dalfox:

cat urls.txt | dalfox pipe --skip-bav --only-poc

SQL Injection Discovery

For SQL Injection discovery:

cat urls.txt | gf sqli | sqlmap --batch --random-agent -m -

Subdomain Takeovers - Quick Check

Want to check for subdomain takeovers in one line?

subfinder -d example.com | httpx -silent | nuclei -silent -t takeovers/ -o takeover.txt

Subdomain Discovery + Live Check

For subdomain discovery with live check:

subfinder -d target.com | httpx -silent -mc 200

Subdomain Takeover Detection

Detect subdomain takeovers:

subfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/

Directory Bruteforce (Content Discovery)

For directory bruteforce:

ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200

Find Open Redirects (Quick Scan)

To quickly find open redirects:

cat urls.txt | gf redirect | httpx -silent

XSS Detection (Using Dalfox)

For XSS detection using Dalfox:

cat urls.txt | dalfox pipe --skip-bav --only-poc

SQL Injection Discovery

For SQL Injection discovery:

cat urls.txt | gf sqli | sqlmap --batch --random-agent -m -

Find Sensitive Files (Backup, Config, etc.)

To find sensitive files like backups and configuration files:

cat urls.txt | waybackurls | grep -Ei '\.(bak|old|backup|log|env|sql|config)$'

CORS Misconfiguration Detection

To detect CORS misconfigurations:

cat urls.txt | corscanner

Detect Technologies + Possible CVEs

To detect technologies and possible CVEs:

cat urls.txt | httpx -silent -title -tech-detect | nuclei -silent -t cves/

Parameter Discovery (for further testing)

To discover parameters for further testing:

cat urls.txt | waybackurls | uro | grep '?'

Full Recon Chain (Subdomains + Live Check + Technologies + Titles)

For full recon chain:

subfinder -d target.com | httpx -silent -title -tech-detect

Subdomain Enum + Ports Scan (Fast)

For a fast subdomain enumeration and port scan:

subfinder -d target.com | naabu -silent -top-ports 1000

All URLs from Wayback, CommonCrawl, and AlienVault

To get all URLs from Wayback, CommonCrawl, and AlienVault:

gau target.com | tee urls.txt

Find Secrets in JS Files

To find secrets in JS files:

cat urls.txt | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'curl -s {} | tr "[:space:]" "\n" | grep -Ei "(api|key|token|secret|password|passwd|authorization)="'

Find Open AWS Buckets

To find open AWS buckets:

subfinder -d target.com | httpx -silent | nuclei -silent -t s3-detect.yaml

Find Misconfigured Login Panels

To find misconfigured login panels:

cat urls.txt | nuclei -silent -t exposed-panels/

Check All Parameters for Reflected XSS

To check all parameters for reflected XSS:

cat urls.txt | gf xss | dalfox pipe --skip-bav --only-poc

Check for Exposed Git Repositories

To check for exposed Git repositories:

cat urls.txt | httpx -silent -path "/.git/config" -mc 200

Extract All Parameters from URLs (for manual testing)

To extract all parameters from URLs for manual testing:

cat urls.txt | uro | grep '?'

Takeover Domains from Subdomain List

To perform takeover checks on domains from a subdomain list:

cat subdomains.txt | nuclei -silent -t takeovers/

Find CVEs Based on Technology

To find CVEs based on technology:

cat urls.txt | httpx -silent -title -tech-detect | nuclei -silent -t cves/

Find Top Ports + Services for All Subdomains (Recon + Port Scan)

To find the top ports and services for all subdomains:

subfinder -d target.com | naabu -top-ports 1000 -silent

Extract All Endpoints from JS Files (JS Analysis)

To extract all endpoints from JS files for analysis:

cat urls.txt | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'curl -s {} | grep -oE "(/api/v[0-9]+/[^\"'\'']+|/[a-zA-Z0-9_/.-]+\.(php|aspx|jsp|html|json|xml|txt))"'

Subdomain Discovery + Live Check

For subdomain discovery with live check:

subfinder -d target.com | httpx -silent -mc 200

Subdomain Takeover Detection

Detect subdomain takeovers:

subfinder -d target.com | httpx -silent | nuclei -silent -t takeovers/

Directory Bruteforce (Content Discovery)

For directory bruteforce:

ffuf -u https://target.com/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -mc 200

Find Open Redirects (Quick Scan)

To quickly find open redirects:

cat urls.txt | gf redirect | httpx -silent

XSS Detection (Using Dalfox)

For XSS detection using Dalfox:

cat urls.txt | dalfox pipe --skip-bav --only-poc

SQL Injection Discovery

For SQL Injection discovery:

cat urls.txt | gf sqli | sqlmap --batch --random-agent -m -

Find Sensitive Files (Backup, Config, etc.)

To find sensitive files like backups and configuration files:

cat urls.txt | waybackurls | grep -Ei '\.(bak|old|backup|log|env|sql|config)$'

CORS Misconfiguration Detection

To detect CORS misconfigurations:

cat urls.txt | corscanner

Detect Technologies + Possible CVEs

To detect technologies and possible CVEs:

cat urls.txt | httpx -silent -title -tech-detect | nuclei -silent -t cves/

Parameter Discovery (for further testing)

To discover parameters for further testing:

cat urls.txt | waybackurls | uro | grep '?'

Full Recon Chain (Subdomains + Live Check + Technologies + Titles)

For full recon chain:

subfinder -d target.com | httpx -silent -title -tech-detect

Subdomain Enum + Ports Scan (Fast)

For a fast subdomain enumeration and port scan:

subfinder -d target.com | naabu -silent -top-ports 1000

All URLs from Wayback, CommonCrawl, and AlienVault

To get all URLs from Wayback, CommonCrawl, and AlienVault:

gau target.com | tee urls.txt

Find Secrets in JS Files

To find secrets in JS files:

cat urls.txt | grep '\.js$' | httpx -silent | xargs -I{} bash -c 'curl -s {} | tr "[:space:]" "\n" | grep -Ei "(api|key|token|secret|password|passwd|authorization)="'

Find Open AWS Buckets

To find open AWS buckets:

subfinder -d target.com | httpx -silent | nuclei -silent -t s3-detect.yaml

Find Misconfigured Login Panels

To find misconfigured login panels:

cat urls.txt | nuclei -silent -t exposed-panels/

Check All Parameters for Reflected XSS

To check al

OneLinerBounty

Install / Use

README

Why OneLiners?

Misconfigurations, Tech Detection, and Common Bugs

Subdomain Takeovers - Quick Check

Subdomain Discovery + Live Check

Subdomain Takeover Detection

Directory Bruteforce (Content Discovery)

Find Open Redirects (Quick Scan)

XSS Detection (Using Dalfox)

SQL Injection Discovery

Subdomain Takeovers - Quick Check

Subdomain Discovery + Live Check

Subdomain Takeover Detection

Directory Bruteforce (Content Discovery)

Find Open Redirects (Quick Scan)

XSS Detection (Using Dalfox)

SQL Injection Discovery

Find Sensitive Files (Backup, Config, etc.)

CORS Misconfiguration Detection

Detect Technologies + Possible CVEs

Parameter Discovery (for further testing)

Full Recon Chain (Subdomains + Live Check + Technologies + Titles)

Subdomain Enum + Ports Scan (Fast)

All URLs from Wayback, CommonCrawl, and AlienVault

Find Secrets in JS Files

Find Open AWS Buckets

Find Misconfigured Login Panels

Check All Parameters for Reflected XSS

Check for Exposed Git Repositories

Extract All Parameters from URLs (for manual testing)

Takeover Domains from Subdomain List

Find CVEs Based on Technology

Find Top Ports + Services for All Subdomains (Recon + Port Scan)

Extract All Endpoints from JS Files (JS Analysis)

Subdomain Discovery + Live Check

Subdomain Takeover Detection

Directory Bruteforce (Content Discovery)

Find Open Redirects (Quick Scan)

XSS Detection (Using Dalfox)

SQL Injection Discovery

Find Sensitive Files (Backup, Config, etc.)

CORS Misconfiguration Detection

Detect Technologies + Possible CVEs

Parameter Discovery (for further testing)

Full Recon Chain (Subdomains + Live Check + Technologies + Titles)

Subdomain Enum + Ports Scan (Fast)

All URLs from Wayback, CommonCrawl, and AlienVault

Find Secrets in JS Files

Find Open AWS Buckets

Find Misconfigured Login Panels

Check All Parameters for Reflected XSS