Skip to Content


Bug Bounty Tools

🎯 Top Bug Bounty Tools (Download + Install + Usage Guide)

Bug bounty hunters rely on a strong toolkit to perform reconnaissance, expand attack surfaces, automate workflows, and discover security vulnerabilities in real-world applications.

Below are 6 essential bug bounty tools every beginner and intermediate hunter should master.

🔥 1. Subfinder — Passive Subdomain Enumeration

Official Link / Download:

https://github.com/projectdiscovery/subfinder

✅ Steps to Install

Linux (Recommended)
sudo apt install golang-go
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

Add Go binaries to PATH:

export PATH=$PATH:$(go env GOPATH)/bin
Kali Linux (Prebuilt Binary)
sudo apt-get install subfinder
Windows

Download binary:

https://github.com/projectdiscovery/subfinder/releases

📝 How to Use

  • Basic scan:

subfinder -d example.com

  • Save results:

subfinder -d example.com -o subs.txt

  • Use all sources:

subfinder -d example.com -all

Used for:

Passive subdomain discovery, expanding attack surface, finding forgotten assets.

🔥 2. Amass — Deep Subdomain & Attack Surface Mapping

Official Download:

https://github.com/owasp-amass/amass

✅ Steps to Install

Linux
sudo snap install amass

OR manually:

sudo apt install amass
Windows

Download from releases:

https://github.com/owasp-amass/amass/releases

📝 How to Use

  • Basic enumeration:

amass enum -d example.com

  • Active + passive scanning:

amass enum -active -d example.com

  • Save results:

amass enum -d example.com -o amass.txt

Used for:

Large-scale recon, mapping hidden subdomains, finding vulnerable endpoints.

🔥 3. Nuclei — Vulnerability Scanner

Official Download:

https://github.com/projectdiscovery/nuclei

✅ Steps to Install

Linux
go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
Windows

Download binary:

https://github.com/projectdiscovery/nuclei/releases

Update templates:

nuclei -update-templates
📝 How to Use

  • Basic scan:

nuclei -u https://example.com

  • Scan multiple URLs:

nuclei -l urls.txt

  • Specific template category:

nuclei -u example.com -t cves/

Used for:

Scanning for misconfigurations, CVEs, sensitive files, exposures, takeover issues.

🔥 4. ParamSpider — Sensitive Parameter Finder

Official Download:

https://github.com/devanshbatham/ParamSpider

✅ Steps to Install

git clone https://github.com/devanshbatham/ParamSpider
cd ParamSpider
pip3 install -r requirements.txt
📝 How to Use

Search for potential vulnerable parameters:

python3 paramspider.py --domain example.com

Save results:

python3 paramspider.py --domain example.com --output params.txt

Used for:

Finding URL parameters vulnerable to XSS, SQLi, open redirect, and IDOR.

🔥 5. Waybackurls — Discover Archived Endpoints

Official Download:

https://github.com/tomnomnom/waybackurls

✅ Steps to Install

Linux
go install github.com/tomnomnom/waybackurls@latest

Add to PATH:

export PATH=$PATH:$(go env GOPATH)/bin

📝 How to Use

  • Get all historical URLs:

echo example.com | waybackurls

  • Save results:

echo example.com | waybackurls > urls.txt

Used for:

Finding hidden endpoints, old API paths, deprecated pages, potential vulnerabilities.

🔥 6. HTTPX — Web Probe & Recon Tool

Official Download:

https://github.com/projectdiscovery/httpx

✅ Steps to Install

Linux

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

Windows

Download binary from releases.

📝 How to Use

  • Probe URLs:

cat subs.txt | httpx

  • Get status codes + tech stack:

cat subs.txt | httpx -status-code -title -tech-detect

Used for:

Checking live hosts, extracting tech stack, identifying redirects & HTTP responses.