> For the complete documentation index, see [llms.txt](https://gowthams.gitbook.io/bughunter-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gowthams.gitbook.io/bughunter-handbook/oneliners.md).

# Oneliner Collections

**Links:**

* <https://github.com/OfJAAH/KingOfBugBountyTips>
* <https://github.com/dwisiswant0/awesome-oneliner-bugbounty>
* <https://github.com/twseptian/oneliner-bugbounty>

Content Discovery:

```
mkdir -p subs assets
subfinder -d example.com -all -nW -o subs/subfinder.txt
assetfinder -subs-only -d example.com | tee subs/assetfinder.txt
amass enum -d example.com -o subs/amass.txt
#run other subdomain tools if you want.
cat subs/*txt | sort -u > subs/all.txt

#Look for alive subdomains.
cat subs/all.txt | httpx -o assets/subs.txt

#Now let's find more assets.
cat assets/subs.txt | feroxbuster --stdin -e -w {put some good wordlist here} | tee assets/feroxbuster.txt
#For the wordlist i recomend OneListForAll: https://github.com/six2dez/OneListForAll
```

Simple script to look for juice endpoints with gau and gf

![](/files/-MT4EGAuDlj-hi4g48PH)

```
DNS Recon and Fuzzing with FFUF in one line Fisted hand

curl -s https://crt.sh\?q\=\%.$1\&output\=json | jq -r '.[].name_value' | gsed 's/^/https:\/\//' | sort -u | xargs -n 1 -I{} ffuf -w ~/common.txt -u {}/FUZZ -t 70 > fuzzing_domain.txt

```

![https://twitter.com/hex0x42424242/status/1299431571792027650?s=20](/files/-MTFzVir-jnI3fY8pIR-)

{% embed url="<https://twitter.com/Alra3ees/status/1299575912367902721?s=20>" %}

{% embed url="<https://twitter.com/Alra3ees/status/1356015561885556739?s=20>" %}

{% embed url="<https://twitter.com/panch0r3d/status/1441861036441747456?s=20>" %}

{% embed url="<https://twitter.com/remonsec/status/1441617313250172930?s=20>" %}

{% embed url="<https://twitter.com/Alra3ees/status/1393188422156800005?s=20>" %}

{% embed url="<https://twitter.com/Alra3ees/status/1356015561885556739?s=20>" %}