Bug Bounty Dork Reference

Broad sweep for sensitive file types left indexed by misconfigured servers. Any hit warrants immediate manual review.

Exported user data files in spreadsheet formats. Common result of misconfigured automated reports, data exports, or BI tool leakage.

JWT tokens always start with "eyJ" (base64 header). Exposed JWTs in indexed files may allow session hijacking or API auth bypass.

OAuth tokens or bearer tokens in indexed content. Token theft enables account takeover without needing a password.

Email API keys enable sending phishing at scale from a trusted domain and exfiltrating contact lists.

Backup files of PHP/ASP scripts expose server-side source code. Web server backups of config files expose credentials.

Application logs containing credentials or tokens. Verbose logging in auth flows frequently captures tokens in log lines.

htpasswd contains bcrypt/MD5-hashed HTTP Basic Auth credentials. htaccess reveals server configuration and access rules.

Configuration files expose database credentials, API keys, and infrastructure details. Often the root cause of credential leaks.

Update and plugin install endpoints that accept uploaded files. Without signature or checksum verification this is an integrity failure — arbitrary files can be loaded as trusted code.

Administrative interfaces typically have less testing coverage, weaker auth, and higher-privilege functionality.

Test environments: weaker security controls, debug features enabled, production data copies, and reduced monitoring.

Session or auth tokens embedded in URLs get logged in server logs, browser history, and referer headers. Any indexed URL with a live token is an immediate account takeover vector.

Parameters commonly reflected in templates or responses. Reflected XSS is highly likely in legacy PHP/Java apps that don't encode output.

Database identifier parameters used in WHERE clauses. High SQLi likelihood if application doesn't use parameterized queries.

Parameters accepting URLs — prime SSRF targets. Can reach cloud metadata (169.254.169.254), internal services, and AWS IMDSv1.

File path parameters. Local File Inclusion can read /etc/passwd, /proc/self/environ, and chain to RCE via log poisoning.

Direct object reference parameters. Increment/change numeric or GUID values to access other users' data (IDOR).

Registration and update endpoints accepting privilege-related parameters. Mass assignment allows any user to set role=admin or isAdmin=true if the server binds request params directly to the model.

XML-consuming endpoints. XXE injection can read server files, trigger SSRF, or in some parsers lead to DoS.

GraphQL with introspection enabled exposes full schema. Misconfigured resolvers enable IDOR, mass assignment, and auth bypass.

Postman collections often contain hardcoded API keys, auth tokens, and internal endpoint documentation.

Finds S3 buckets referencing the target. Public buckets lead to data exposure; misconfigured write ACLs enable file upload.

Alternative S3 regional and dual-stack endpoints that may host public buckets referencing the target.

Azure Blob containers with public access expose stored files — backups, exports, user uploads, and build artifacts.

GCP Cloud Storage buckets with public access. Often contains application data, ML training sets, or user uploads.

Firebase Realtime Database and Firestore. Misconfigured security rules allow unauthenticated read/write of all data.

DigitalOcean Spaces (S3-compatible) with public access expose all stored objects including backups and uploads.

JFrog instances may expose internal packages, build artifacts, and deployment credentials in artifact metadata.

Exposed audit trails and access logs that should be internal-only. These reveal user actions, admin operations, and sometimes authentication events with tokens.

AEM has numerous known issues: SSRF via DAM, CRXDE Lite RCE, SlingPostServlet data exposure, and GQL endpoint IDOR.

Salesforce communities with misconfigured guest profiles expose CRM data: contacts, leads, opportunities, cases.

Paste sites frequently contain dumped credentials, API keys, and internal data shared accidentally or by malicious insiders.

GitHub search for target domain + secret keywords. Developers frequently commit credentials — and GitHub search is persistent even after deletion.

GitLab public repos and snippets referencing the target. Source code, CI configs, and hardcoded credentials are common finds.

Bitbucket public repos referencing the target. Often associated with Atlassian-stack companies and Java/enterprise codebases with hardcoded credentials.