# HowToHunt

## HowToHunt

- [HowToHunt.md](https://kathan19.gitbook.io/howtohunt/readme.md)
- [Hidden API Functionality Exposure](https://kathan19.gitbook.io/howtohunt/api-testing/hidden_api_functionality_exposure.md)
- [Reverse Engineer an API](https://kathan19.gitbook.io/howtohunt/api-testing/reverse_engineer_an_api.md)
- [Account Takeover Methodology](https://kathan19.gitbook.io/howtohunt/account-takeover-methodology/account_takeovers_methods.md)
- [Application Level DoS Methods](https://kathan19.gitbook.io/howtohunt/application-level-dos/ald_methods.md)
- [2FA Bypasses](https://kathan19.gitbook.io/howtohunt/authentication-bypass/2fa_bypasses.md)
- [OTP Bypass](https://kathan19.gitbook.io/howtohunt/authentication-bypass/otp_bypass.md)
- [Account Ban Bypass](https://kathan19.gitbook.io/howtohunt/authentication-bypass/account_ban_bypass.md)
- [Broken-Link Hijacking](https://kathan19.gitbook.io/howtohunt/broken-link-hijacking/brokenlinkhijacking.md)
- [Session Based Bugs](https://kathan19.gitbook.io/howtohunt/broken-auth-and-session-management/session_based_bugs.md)
- [AEM](https://kathan19.gitbook.io/howtohunt/cms/aem.md)
- [Drupal](https://kathan19.gitbook.io/howtohunt/cms/drupal.md)
- [Wordpress](https://kathan19.gitbook.io/howtohunt/cms/wordpress.md)
- [Moodle](https://kathan19.gitbook.io/howtohunt/cms/moodle.md)
- [CORS](https://kathan19.gitbook.io/howtohunt/cors/cors.md)
- [CORS Bypasses](https://kathan19.gitbook.io/howtohunt/cors/cors_bypasses.md)
- [CSRF](https://kathan19.gitbook.io/howtohunt/csrf/csrf.md)
- [CSRF MindMap](https://kathan19.gitbook.io/howtohunt/csrf/csrf-1.md)
- [CSRF Bypass](https://kathan19.gitbook.io/howtohunt/csrf/cross_site_request_forgery_bypass.md)
- [CVES](https://kathan19.gitbook.io/howtohunt/finding-cves/easycve.md)
- [Web Application Pentesting Checklist](https://kathan19.gitbook.io/howtohunt/checklist/web-application-pentesting-checklist.md)
- [Web Page Code Review Tips](https://kathan19.gitbook.io/howtohunt/web-page-source-code-review/codereviewtips.md)
- [EXIF Geo Data Not Stripped](https://kathan19.gitbook.io/howtohunt/exif-geo-data-not-stripped/exif_geo.md)
- [File Upload Bypass](https://kathan19.gitbook.io/howtohunt/file-upload-bypass/file_upload.md)
- [Find Origin](https://kathan19.gitbook.io/howtohunt/find-origin-ip/findorigin.md)
- [GraphQL](https://kathan19.gitbook.io/howtohunt/graphql/graphql.md)
- [HTTP\_Desync](https://kathan19.gitbook.io/howtohunt/http-desync-attack/http_desync.md)
- [Host-Header](https://kathan19.gitbook.io/howtohunt/host-header-attack/host-header.md)
- [HTML-Injection](https://kathan19.gitbook.io/howtohunt/html-injection/html_injection_on_password_reset_page.md)
- [IDOR](https://kathan19.gitbook.io/howtohunt/idor/idor.md)
- [JWT](https://kathan19.gitbook.io/howtohunt/jwt-attack/jwt.md)
- [JIRA](https://kathan19.gitbook.io/howtohunt/jira-attack/jira.md)
- [MFA Bypasses](https://kathan19.gitbook.io/howtohunt/mfa-bypass/mfa_bypasses.md)
- [2FA-Bypass](https://kathan19.gitbook.io/howtohunt/mfa-bypass/2fa_bypass.md)
- [Default Credential And Admin Panel](https://kathan19.gitbook.io/howtohunt/misconfigurations/default-credential-and-admin-panel.md)
- [Docker](https://kathan19.gitbook.io/howtohunt/misconfigurations/docker.md)
- [S3 Bucket](https://kathan19.gitbook.io/howtohunt/misconfigurations/s3-bucket_misconfig.md)
- [OAuth](https://kathan19.gitbook.io/howtohunt/oauth/oauth.md)
- [OAuth Hunting](https://kathan19.gitbook.io/howtohunt/oauth/oauth-2.0-hunting-methodology.md)
- [Find OpenRedirect Trick](https://kathan19.gitbook.io/howtohunt/open-redirection/find_openredirect_trick.md)
- [Open Redirection Bypass](https://kathan19.gitbook.io/howtohunt/open-redirection/open_redirection_bypass.md)
- [Parameter Pollution In Social Sharing Buttons](https://kathan19.gitbook.io/howtohunt/parameter-pollution/parameter_pollution_in_social_sharing_buttons.md)
- [MindMap](https://kathan19.gitbook.io/howtohunt/password-reset-functionality/password_reset_functionality.md)
- [Password Reset Token Leakage](https://kathan19.gitbook.io/howtohunt/password-reset-functionality/password_reset_token_leakage.md)
- [Account\_Takeover\_By\_Password\_Reset\_Functionality](https://kathan19.gitbook.io/howtohunt/password-reset-functionality/account_takeover_by_password_reset_functionality.md)
- [Password\_Reset\_Flaws](https://kathan19.gitbook.io/howtohunt/password-reset-functionality/password_reset_flaws_by_sm4rty.md)
- [Rate Limit Flaws](https://kathan19.gitbook.io/howtohunt/rate-limit/rate_limit.md)
- [Rate-Limit Bypass](https://kathan19.gitbook.io/howtohunt/rate-limit/ratelimitbypass.md)
- [No Rate-Limit on Verify-PhoneNo](https://kathan19.gitbook.io/howtohunt/rate-limit/no-rate-limit-on-verify-phoneno.md)
- [No Rate-limit on Invite User](https://kathan19.gitbook.io/howtohunt/rate-limit/no-rate-limit-on-invite-user.md)
- [No Rate-limit on Promo](https://kathan19.gitbook.io/howtohunt/rate-limit/no-rate-limit-on-promo.md)
- [No Rate-limit on Verify-email](https://kathan19.gitbook.io/howtohunt/rate-limit/no-rate-limit-on-verify-email.md)
- [No Rate-limit on forget-password](https://kathan19.gitbook.io/howtohunt/rate-limit/no-rate-limit-on-forget-password.md)
- [Race Condition](https://kathan19.gitbook.io/howtohunt/race-condition/race_conditions.md)
- [Github](https://kathan19.gitbook.io/howtohunt/recon/github_dorking.md)
- [Recon Workflow](https://kathan19.gitbook.io/howtohunt/recon/workflow.md)
- [Subdomain Enumeration](https://kathan19.gitbook.io/howtohunt/recon/subdomain_enumeration.md)
- [SQL Injection.md](https://kathan19.gitbook.io/howtohunt/sqli/sql_injection.md)
- [SAML](https://kathan19.gitbook.io/howtohunt/saml/saml.md)
- [SSRF](https://kathan19.gitbook.io/howtohunt/ssrf/ssrf.md)
- [Blind SSRF](https://kathan19.gitbook.io/howtohunt/ssrf/blind_ssrf.md)
- [SSTI](https://kathan19.gitbook.io/howtohunt/ssti/ssti.md)
- [Sign Up Bugs](https://kathan19.gitbook.io/howtohunt/sign-up-functionality/hunting_for_bugs_in_signup_feature.md)
- [Sign Up MindMap](https://kathan19.gitbook.io/howtohunt/sign-up-functionality/sign-up-mindmap.md)
- [Github Recon Method](https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/github_recon_method.md)
- [Github-Dorks](https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/github-dorks.md)
- [Github Dorks All](https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/github_dorks_all.md)
- [Google Dorks](https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/google_dorks.md)
- [Shodan CVE Dorks](https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/shodan_cve_dorks.md)
- [Version Leaks](https://kathan19.gitbook.io/howtohunt/sensitive-info-leaks/version_leak.md)
- [Status\_Code\_Bypass Tips](https://kathan19.gitbook.io/howtohunt/status-code-bypass/status_code_bypass.md)
- [403 Bypass](https://kathan19.gitbook.io/howtohunt/status-code-bypass/403bypass.md)
- [Subdomain Takeover - Detail Method](https://kathan19.gitbook.io/howtohunt/subdomain-takeover/subdomain_takeover.md)
- [Subdomain Takeover - Easy Method](https://kathan19.gitbook.io/howtohunt/subdomain-takeover/easy_methods.md)
- [Subs or Top level Domain](https://kathan19.gitbook.io/howtohunt/subdomain-takeover/sub_or_top_level_domain_takeover.md)
- [Tabnabbing](https://kathan19.gitbook.io/howtohunt/tabnabbing/tabnabbing.md)
- [WAF Bypass Using Headers](https://kathan19.gitbook.io/howtohunt/waf-bypasses/waf_bypass_using_headers.md)
- [Weak Password Policy](https://kathan19.gitbook.io/howtohunt/weak-password-policy/weak_password_policy.md)
- [XSS](https://kathan19.gitbook.io/howtohunt/xss/xss.md)
- [Bypass CSP](https://kathan19.gitbook.io/howtohunt/xss/bypass_csp.md)
- [XSS Bypass](https://kathan19.gitbook.io/howtohunt/xss/xss_bypass.md)
- [Automated XSS](https://kathan19.gitbook.io/howtohunt/xss/automated_xss.md)
- [Post Message Xss](https://kathan19.gitbook.io/howtohunt/xss/post_message_xss.md)
- [XXE Methods](https://kathan19.gitbook.io/howtohunt/xxe/xxe_methods.md)
- [Billion Laugh Attack](https://kathan19.gitbook.io/howtohunt/xxe/billion_laugh_attack.md)