Listen to this Post
Introduction:
Reconnaissance is the critical first phase of any bug bounty hunt or penetration test, forming the foundation upon which successful attacks are built. This initial information-gathering process involves systematically mapping a target’s external attack surface to identify potential entry points and vulnerabilities. By mastering both passive and active recon techniques, security professionals can efficiently prioritize targets and uncover hidden weaknesses before malicious actors do.
Learning Objectives:
- Understand the core methodologies of passive and active reconnaissance.
- Learn to utilize essential command-line tools for subdomain enumeration, service discovery, and vulnerability probing.
- Develop a structured workflow for correlating recon data to identify high-value targets.
You Should Know:
1. Subdomain Enumeration with Amass
Subdomain discovery is crucial for expanding the attack surface beyond the obvious primary domain.
Command:
amass enum -passive -d target.com -o subdomains_passive.txt amass enum -active -d target.com -o subdomains_active.txt
Step-by-Step Guide:
Amass is a powerful tool for mapping external attack surfaces. The `-passive` flag gathers data from open-source intelligence (OSINT) without directly interacting with the target, minimizing network noise. The `-active` flag performs more intrusive DNS resolution and brute-forcing. Start with passive enumeration to gather initial intelligence, then proceed to active enumeration for a more comprehensive list. Always combine results and sort for unique entries using sort -u.
2. Subdomain Bruteforcing with FFUF
For discovering hidden or non-public subdomains, bruteforcing with a wordlist is highly effective.
Command:
ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/namelist.txt -u https://FUZZ.target.com -o ffuf_results.json -of json
Step-by-Step Guide:
FFuf is a fast web fuzzer. This command takes a wordlist (-w) and replaces the `FUZZ` keyword in the URL with each entry. It sends HTTP requests and filters responses to find valid subdomains. Use a large, well-curated wordlist like those found in the `SecLists` project. The `-of json` option outputs results in JSON format for easy parsing with other tools. Pay attention to the response codes and sizes to identify live hosts.
3. Service Discovery with Nmap
Identifying open ports and running services on discovered hosts is the next logical step.
Command:
nmap -sC -sV -p- -T4 -oA full_tcp_scan target_ip
Step-by-Step Guide:
This Nmap command performs a comprehensive TCP scan. `-sC` runs default scripts, `-sV` probes for service/version information, and `-p-` scans all 65,535 ports. `-T4` sets the timing template for faster execution, and `-oA` outputs results in all major formats. Analyze the output to understand what services are running and on which ports, which directly informs subsequent vulnerability assessment steps.
4. HTTP Service Interrogation with Curl
Manually inspecting web server headers can reveal valuable information like the server type, framework, and potential misconfigurations.
Command:
curl -I https://target.com
Step-by-Step Guide:
The `-I` (head) option fetches only the HTTP headers. Key headers to analyze include Server, X-Powered-By, Set-Cookie, and Strict-Transport-Security. Look for outdated software versions or missing security headers that could indicate potential vulnerabilities. This simple command is a quick way to gain initial insights into a web application’s security posture.
5. Visual Reconnaissance with Aquatone
Organizing and visualizing the results of subdomain enumeration helps in prioritizing targets.
Command:
cat discovered_subdomains.txt | aquatone -ports xlarge
Step-by-Step Guide:
Aquatone takes a list of hosts and performs port scanning, screenshotting, and technology detection. It generates an HTML report that provides a visual overview of the target. The `-ports xlarge` option scans a comprehensive list of common ports. Use this report to quickly identify interesting web applications, development stacks, and outlier services that may be less secure.
6. Content Discovery with Gobuster
Finding hidden directories and files is essential for uncovering administrative interfaces, backup files, and API endpoints.
Command:
gobuster dir -u https://target.com -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak -o gobuster_scan.txt
Step-by-Step Guide:
Gobuster brute-forces directories and file names on a web server. The `-u` flag specifies the URL, `-w` the wordlist, and `-x` the file extensions to check for. Start with a common wordlist and then move to larger, more comprehensive lists. discovered endpoints often lead to sensitive information, debug panels, or unprotected files containing credentials.
7. JavaScript Analysis for Hidden Endpoints
Modern web applications often contain a wealth of API endpoints and hidden paths within their client-side JavaScript files.
Command:
cat js_files.txt | while read url; do curl -s $url | grep -Eo "([a-zA-Z0-9_-./?=&])+.(json|api|action)" | sort -u; done
Step-by-Step Guide:
First, use a tool like `subjs` or `katana` to crawl the target and extract all linked JavaScript files, saving them to js_files.txt. This Bash one-liner then curls each file and uses `grep` with a regular expression to extract strings that look like API endpoints or dynamic paths. These discovered endpoints are prime targets for testing authentication bypass and injection vulnerabilities.
What Undercode Say:
- Automation is Key, but Context is King: The sheer volume of data generated during reconnaissance necessitates automation. However, the real skill lies in manually reviewing and correlating findings to identify anomalies and high-value targets that automated tools might miss. A poorly configured staging server or a forgotten developer blog can often be more valuable than the main application.
- Persistence and Continuous Monitoring: Attack surfaces are not static. New subdomains, cloud buckets, and applications are deployed regularly. Successful bug bounty hunters incorporate continuous reconnaissance into their workflow, using scripts and monitors to alert them to changes in their target’s footprint, often catching vulnerabilities immediately after deployment.
Prediction:
The future of reconnaissance will be dominated by AI-driven intelligence aggregation. Tools will evolve beyond simple enumeration to proactively correlate data points from code repositories, certificate transparency logs, and cloud misconfigurations to predict and prioritize vulnerable assets before they are widely known. This will shift bug bounty hunting from a reactive to a predictive discipline, forcing organizations to adopt equally advanced attack surface management platforms to maintain visibility. Reconnaissance will become less about finding what’s there and more about understanding the contextual risk of every exposed asset in real-time.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/d8ngXs_r – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
