These are my checklists which I use during my bug bounty hunting.
- Testing 2 Factor Authentication
- Captcha Bypass
- Bypassing CSRF Protection
- Testing Password Reset Functionality
- Bypassing Rate Limit Protection
- JWT Misconfiguration
- Abusing Support Portal
- Application Level Dos
- OAuth Misconfiguration