BountyHunterInChina: sixteen SRC case studies, in Chinese and in English

A publication, not a project

This repository holds no code. It is a collection of real world bug bounty and SRC hunting stories from China, describing how vulnerabilities were actually found, chained and reported, written by working security engineers, and the README states that all articles are educational write-ups. The format is PDF. The original Chinese PDFs sit in the repository root, with long Chinese filenames that carry the series number, the topic and sometimes the specific technique, and the English translations live in an `en/` directory. The README explains one detail that matters for anyone reading the translations, which is that each English PDF keeps the original figures from the Chinese edition and only the body text has been translated. That is a sensible choice, since the figures in these write-ups are screenshots, request and response dumps and code snippets, and redoing them in translation would have introduced errors. The result is a reading library with a bilingual entry point rather than a repository you can build or run, and the licence is one GitHub cannot classify, which is worth resolving before you redistribute anything from it.

Sixteen numbered cases and three side pieces

The index in the README is the best summary of the collection, and it is a taxonomy of bug hunting problems rather than a list of exploits. The numbered entries run from a SOAP injection on an SRC, through reverse engineering an app to crack its packet signature for arbitrary data replay, a straightforward getshell, a client-side RCE combined with a server-side XXE, and multiple techniques for bypassing a WAF to find XSS at a well known vendor. The sixth is the most aggressive, an aggressive fuzzing run that goes from SSRF to Redis password spraying and mass reverse shells. The seventh and later entries widen the range, with a fuzzing to XSS path that targets personal information on an SRC's own site, a sleight of hand getshell, a chain from an untriggerable XSS into a set of critical API endpoints, and an abandoned SSO login that led to executive profiles. Later cases include stored XSS with multiple WAF bypasses, a file upload fight against Fortinet traffic inspection, a late night compromise of an agent backend, four RCEs on a newly launched SRC by exploiting target domain quirks, an SSRF journey from being ignored to being triaged, and a GraphQL bug hunt that ended up ignored. The extras are different in kind: notes on a layer by layer breakthrough in an attack-defense exercise, a city-wide exercise where the author says no 0day was needed, and an account of passing the CISSP exam in 60 days. A combined volume collects the works from before April 2023.

Several authors, and the difference between a case and a write-up

Most entries are by J0o1ey, the repository's owner, but the index credits others as well, with RG contributing two pieces including the one about stealing personal information from an SRC's official site, h0af3ng contributing the XSS chain and the stored XSS with WAF bypasses, and Cat contributing the abandoned SSO to executive profiles case. That matters for how you read them, because the framing is not uniform. Some entries read as case reports, which is what the index titles promise: a technique, a target class, and a triage outcome. The last two numbered entries are examples of that, since the SSRF one is explicitly a journey from ignored to triaged and the GraphQL one explicitly ended up ignored. A write-up of a bug that was never fixed is arguably more instructive than one that was, because it shows what a triage queue does to a report. Other entries, especially the extras, are closer to essays, and the CISSP piece in particular is about the author's own preparation rather than about a target at all.

The series has a biography, and the rename says what it means

The README contains an update history that reads more like a diary, and it explains the project's framing better than the title does. The Chinese series title, 重生之我在安全行业讨口子, is explained as literally meaning reborn, scraping out a living in China's security industry, described as a self-deprecating nod to the tough years the industry has been through. The February 2024 entry explains the rename, which happened on 1 February 2024, and says the new title reflects the reality of surviving in the field while still telling a few interesting technical stories, and that telling those stories was the whole point of the rename. The April 2023 entry is more personal, describing a year in which the author's small business was not going to survive, the emotional cost of running a company, and the decision to give himself time to settle down and find his original interest. The most quotable line in the whole README is his answer to the question friends kept asking, which is that after learning the OWASP Top 10, the way to hunt bugs effectively is to build up your fundamentals, repeated three times. The rename from a neutral title to a self-deprecating one is the clearest statement of intent in the repository.

A community channel, a training business, and a document repository

The community section describes a WeChat discussion group that was created by popular request, with the practical note that if the QR code has expired or the group is full, you contact the author on WeChat to be invited, and that everyone is welcome to discuss advanced bug hunting and attack-defense cases, or simply what life is like in the industry. The author also asks for technical exchanges, with a characteristic aside that hopefully everyone learns something from the conversation rather than one side doing all the asking. There is a business side, which the README states plainly: the author runs full-stack white-box and black-box vulnerability hunting and attack-defense training, and invites people with compliant project needs to get in touch by private message. That is a normal arrangement for a working security professional who writes up their work, and it is stated rather than hidden, which is the right way to handle it. The README's index ends with a note that contributions are welcome.

What the PDF format costs the reader, and what it still gives

The format is the main practical drawback, and it is worth being specific about it. Nothing in the repository is greppable, so if you want to find every mention of a technique across the collection you are reading sixteen PDFs one at a time, and the only index is the table in the README. There is no code to run, so you cannot reproduce a case from the repository alone, and the screenshots that carry much of the evidence are images rather than text, which also means the English translations are not text searchable. On the other hand, the case studies are exactly the kind of content that suffers when it is flattened into a tutorial format, because the hard part of bug hunting is the sequence of decisions, what was tried first, what was dismissed and why, and the reason a report was ignored. A PDF write-up preserves that narrative, and this collection's titles show the author kept the unglamorous outcomes, with one ending in the report being ignored and another going from ignored to triaged, which is a more honest sample than most bug bounty write-ups offer. For a reader, the practical approach is to pick the case closest to the problem you are working on and treat the rest as background on the trade.

Editorial conclusion

Adopt this collection as reading material if you are learning bug bounty or SRC work, especially if you read Chinese, since the original PDFs are the primary artefacts and the English versions are translations that keep the original figures. Do not expect a tool, a corpus or something you can grep, because the repository contains documents rather than code or structured data, and the licence is one GitHub cannot classify, so check the LICENSE file before you redistribute or republish the translations. Before you rely on any technique in it, check the date of the write-up, since the collection includes work from before April 2023 and the tooling in web security moves quickly. The last push was on 2026-09-18, the repository publishes no GitHub releases, and the English and Chinese READMEs are the index to everything inside.

Frequently asked questions

Official sources

1. Issues
2. J0o1ey/BountyHunterInChina on GitHub
3. README