⚠ Authorized testing only. Disclosed public bug-bounty data for defensive/educational research. Use payloads only against systems you are permitted to test.
LogoThe Hacktivity Field GuideReal-world web hacking, catalogued ⌂
🔎
Home
A field guide to disclosed vulnerabilities

Every bug is a specimen.

5,762 real, resolved HackerOne reports — read, triaged, and dissected into reproducible methods. Catalogued by class, tagged by field-mark, cross-referenced to a PortSwigger lab you can run yourself.

231,034
Specimens examined
5,762
Catalogued (kept)
44
Taxonomic classes
Injection
SQL Injection122OS Command Injection85Code Injection86Server-Side Template Injection14LDAP / XML / Other Injection77CRLF / HTTP Response Splitting22XML External Entities (XXE)25Remote File Inclusion4
Client-side
Cross-Site Scripting (XSS)936Cross-Site Request Forgery (CSRF)144Clickjacking20Open Redirect151Content Spoofing & Phishing74
Access control
IDOR / BOLA248Broken Access Control494Privilege Escalation88Mass Assignment16
Auth & session
Authentication & ATO181Session Management61
Server-side
Server-Side Request Forgery (SSRF)181Path Traversal / LFI181Insecure Deserialization69HTTP Request Smuggling33Web Cache Poisoning & Deception36File Upload66
Logic & infra
Business Logic Flaws267Race Conditions42Denial of Service296Security Misconfiguration119Protocol, Config & Infra Injection (long tail)218Supply Chain & Malicious Code31Logging & Monitoring Failures14
Disclosure & crypto
Information Disclosure568Cryptographic Issues91Man-in-the-Middle12
Binary
Memory Corruption324
Emerging
LLM / AI Attacks3