Listen to this Post
Introduction
Reconnaissance is the first and most critical phase of ethical hacking and bug bounty hunting. It involves gathering information about a target to identify vulnerabilities and potential attack vectors. This article covers essential tools and commands for effective reconnaissance, including subdomain enumeration, host discovery, and path probing.
Learning Objectives
- Learn how to discover subdomains using assetfinder
- Identify live hosts with httprobe
- Fetch hidden paths and endpoints using meg
1. Subdomain Enumeration with Assetfinder
Command:
assetfinder example.com | sort -u > subdomains.txt
Step-by-Step Guide:
1. Install assetfinder (if not already installed):
go get -u github.com/tomnomnom/assetfinder
2. Run the command to find subdomains of example.com.
3. The output is saved to `subdomains.txt` for further analysis.
4. Use `sort -u` to remove duplicates.
Why It Matters:
Subdomains often host vulnerable applications or misconfigured services, making them prime targets for bug bounty hunters.
2. Finding Alive Hosts with Httprobe
Command:
cat subdomains.txt | httprobe > alive_hosts.txt
Step-by-Step Guide:
1. Install httprobe:
go get -u github.com/tomnomnom/httprobe
2. Pipe the list of subdomains (subdomains.txt) into httprobe.
3. The tool checks which hosts respond to HTTP/HTTPS requests.
4. Results are saved in `alive_hosts.txt`.
Why It Matters:
Only live hosts are worth investigating, saving time by filtering out inactive domains.
3. Fetching Hidden Paths with Meg
Command:
meg /path/to/wordlist.txt alive_hosts.txt output_dir
Step-by-Step Guide:
1. Install meg:
go get -u github.com/tomnomnom/meg
2. Prepare a wordlist (e.g., common paths like /admin, /login).
3. Run `meg` against the list of live hosts (alive_hosts.txt).
4. Results are stored in `output_dir` for analysis.
Why It Matters:
Hidden paths can expose admin panels, API endpoints, or sensitive files vulnerable to attacks.
4. Advanced Recon with Waybackurls
Command:
cat subdomains.txt | waybackurls > archived_urls.txt
Step-by-Step Guide:
1. Install waybackurls:
go get -u github.com/tomnomnom/waybackurls
2. Pipe subdomains into `waybackurls` to fetch historical URLs from the Wayback Machine.
3. Analyze `archived_urls.txt` for deprecated but still accessible endpoints.
Why It Matters:
Old URLs may still be functional and contain vulnerabilities like outdated software or exposed data.
5. DNS Recon with Dig
Command:
dig example.com ANY +noall +answer
Step-by-Step Guide:
- Use `dig` to query DNS records (ANY fetches all record types).
2. `+noall +answer` filters the output to show only relevant answers. - Look for MX, TXT, and CNAME records that may reveal additional attack surfaces.
Why It Matters:
DNS records can expose email servers, subdomains, or third-party services linked to the target.
What Undercode Say:
- Automation is key: Combine tools like
assetfinder,httprobe, and `meg` into a recon script for efficiency. - Stay updated: New subdomains and endpoints appear frequently—regular scans are necessary.
- Legal compliance: Always obtain permission before scanning targets to avoid legal repercussions.
Analysis:
Reconnaissance tools have evolved to automate tedious tasks, allowing security researchers to focus on exploitation. However, as defenses improve, attackers (and defenders) must adapt by leveraging AI-driven recon tools for deeper analysis. Future trends may include real-time attack surface monitoring and automated vulnerability correlation.
Prediction:
With AI-powered reconnaissance tools on the rise, manual recon may become obsolete. Expect automated platforms that not only discover assets but also prioritize vulnerabilities based on exploitability. Bug bounty hunters must adapt by mastering these advanced tools to stay ahead.
For more hacking insights, join the Telegram group: https://t.me/The7HacX
IT/Security Reporter URL:
Reported By: Saurabh B294b21aa – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
