Listen to this Post
Introduction:
In the world of ethical hacking and bug bounty hunting, reconnaissance is not merely a preliminary step—it is the backbone of every successful vulnerability discovery operation. As security researcher Theekshana Kusal recently demonstrated with his open-sourced bug-hunting-recon repository, a well-structured reconnaissance methodology can transform a chaotic hunt into a streamlined, efficient process that consistently uncovers high-impact vulnerabilities. This comprehensive guide explores the essential tools, techniques, and workflows that form the foundation of modern bug bounty reconnaissance, drawing from industry-standard practices and real-world methodologies.
Learning Objectives:
- Master passive and active subdomain enumeration techniques using industry-standard tools
- Understand how to filter live assets and identify attack surfaces efficiently
- Learn to automate reconnaissance workflows for maximum coverage and minimal manual effort
You Should Know:
1. Passive Subdomain Enumeration: The Foundation of Reconnaissance
Passive subdomain enumeration is the art of discovering subdomains without directly interacting with the target infrastructure. This approach minimizes the risk of detection while maximizing the discovery of hidden assets. The methodology begins with leveraging multiple data sources to build a comprehensive subdomain list.
Step-by-Step Guide:
Step 1: Install Essential Tools
Install Subfinder go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest Install Amass go install -v github.com/OWASP/Amass/v3/...@master Install Assetfinder go install github.com/tomnomnom/assetfinder@latest
Step 2: Create Working Directory Structure
mkdir -p recon/{target,subdomains,live,urls,parameters,findings}
cd recon/target
Step 3: Run Passive Enumeration with Multiple Tools
Using Subfinder for fast passive enumeration subfinder -d target.com -silent -all -recursive -o subfinder_subs.txt Using Amass in passive mode for comprehensive results amass enum -passive -d target.com -o amass_passive_subs.txt Query Certificate Transparency logs curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\.//g' | anew crtsh_subs.txt Combine all results and remove duplicates cat _subs.txt | sort -u | anew all_subs.txt
The `anew` tool from ProjectDiscovery is particularly useful here as it appends only new lines to the output file, preventing duplicates.
2. Active Subdomain Enumeration: Pushing Beyond Passive Discovery
While passive enumeration provides a solid foundation, active techniques uncover subdomains that aren’t publicly indexed. These methods involve DNS brute-forcing, permutation attacks, and resolution validation.
Step-by-Step Guide:
Step 1: Prepare DNS Resolution Infrastructure
Install MassDNS for high-speed DNS resolution git clone https://github.com/blechschmidt/massdns.git cd massdns && make && sudo make install Download quality wordlists wget https://github.com/danielmiessler/SecLists/raw/master/Discovery/DNS/dns-Jhaddix.txt wget https://github.com/assetnote/commonspeak2-wordlists/raw/master/subdomains/subdomains.txt Use a reliable resolver list wget https://raw.githubusercontent.com/janmasarik/resolvers/master/resolvers.txt
Step 2: Perform DNS Brute-Forcing
Using MassDNS for bulk resolution massdns -r resolvers.txt -t A -o S -w massdns_results.txt wordlist.txt Using Shuffledns for intelligent permutation shuffledns -d target.com -list all_subs.txt -r resolvers.txt -o active_subs.txt Resolve and validate with DNSX dnsx -l active_subs.txt -resp -o resolved_subs.txt
The combination of passive and active enumeration typically yields 20-50% more subdomains than using a single approach.
3. HTTP Probing and Live Asset Discovery
Once subdomains are enumerated, the next critical step is determining which assets are actually live and accessible. This phase filters out dead hosts and identifies the attack surface.
Step-by-Step Guide:
Step 1: Install HTTP Probing Tools
Install httpx for fast HTTP probing go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest Install nuclei for vulnerability scanning go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
Step 2: Probe Live Subdomains
Probe subdomains for live HTTP/HTTPS services httpx -l all_subdomains.txt -threads 100 -status-code -title -tech-detect -o live_hosts.txt Filter for specific status codes httpx -l all_subdomains.txt -mc 200,301,302,403 -o live_web_hosts.txt Detect web technologies httpx -l all_subdomains.txt -tech-detect -json -o tech_stack.json
Step 3: Check for Common Ports and Services
Probe common web ports naabu -list all_subdomains.txt -p 80,443,8080,8000,8443,9000 -o ports.txt Combine with httpx for comprehensive scanning naabu -list all_subdomains.txt -p 80,443,8080,8000,8443,9000 -verify | httpx -o verified_live.txt
4. Historical URL Discovery and Endpoint Enumeration
Historical URL discovery tools like `waybackurls` and `gau` (GetAllUrls) are absolute goldmines for bug bounty hunters. These tools extract URLs from the Wayback Machine, Common Crawl, and AlienVault OTX, revealing hidden endpoints, parameters, and old vulnerabilities.
Step-by-Step Guide:
Step 1: Install Historical URL Tools
Install waybackurls go install github.com/tomnomnom/waybackurls@latest Install gau go install github.com/lc/gau/v2/cmd/gau@latest Install unfurl for domain extraction go install github.com/tomnomnom/unfurl@latest
Step 2: Extract Historical URLs
Basic waybackurls usage waybackurls target.com > urls.txt Process multiple domains cat domains.txt | waybackurls > all_urls.txt Using gau with subdomain support gau --subs target.com | tee all_urls.txt
Step 3: Filter and Analyze URLs
Extract JavaScript files for analysis waybackurls target.com | grep ".js$" | sort -u > js_files.txt Find API endpoints waybackurls target.com | grep -Ei "api|v1|v2|graphql" | sort -u > api_endpoints.txt Look for sensitive files waybackurls target.com | grep -Ei ".bak|.old|.backup|.zip|.tar|.gz" > sensitive_files.txt Extract parameters for fuzzing waybackurls target.com | grep "?" | sort -u > parameter_urls.txt
5. Advanced Reconnaissance with Nuclei and Automation
Nuclei is not just a scanner—it’s a framework to automate all repetitive tasks in recon, pentesting, and bug bounty. Integrating Nuclei into your recon process can give you the edge over competitors and help you identify bounties faster.
Step-by-Step Guide:
Step 1: Set Up Nuclei
Install Nuclei go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest Update Nuclei templates nuclei -update-templates Verify installation nuclei -version
Step 2: Run Targeted Scans
Scan live hosts for vulnerabilities nuclei -l live_hosts.txt -t cves/ -o cve_findings.txt Check for misconfigurations nuclei -l live_hosts.txt -t misconfiguration/ -o misconfig_findings.txt Scan for exposed secrets nuclei -l live_hosts.txt -t exposures/ -o secrets_findings.txt Combine with historical URLs waybackurls target.com | nuclei -t vulnerabilities/
Step 3: Create Custom Templates
Create a custom template directory
mkdir -p custom-templates
Example template structure for IDOR testing
cat > custom-templates/idor-test.yaml << EOF
id: idor-test
info:
name: IDOR Test Template
author: researcher
severity: medium
requests:
- method: GET
path:
- "{{BaseURL}}/user/{{rand_int}}"
matchers:
- type: status
status:
- 200
condition: or
EOF
6. Cloud Misconfiguration and API Security Recon
Modern bug bounty programs increasingly involve cloud infrastructure and APIs. Identifying misconfigured cloud storage and vulnerable API endpoints can lead to critical findings.
Step-by-Step Guide:
Step 1: Cloud Reconnaissance
Install cloud_enum for cloud resource discovery git clone https://github.com/initstring/cloud_enum.git cd cloud_enum pip3 install -r requirements.txt Enumerate AWS S3 buckets python3 cloud_enum.py -k target.com -l aws_s3_buckets.txt Check for open buckets aws s3 ls s3://target-bucket/ --1o-sign-request
Step 2: API Security Testing
Install API testing tools pip install apilist Enumerate API endpoints apilist -d target.com -o api_endpoints.txt Test for common API vulnerabilities Using Burp Suite or custom scripts for: - IDOR testing - Authentication bypass - Injection attacks - Rate limiting issues
Step 3: JavaScript Analysis for Secrets
Download and analyze JavaScript files waybackurls target.com | grep ".js$" | while read url; do curl -s "$url" | grep -E "api[_-]?key|token|secret|password" >> potential_secrets.txt done
7. Organizing Findings and Report Generation
Documentation is crucial for successful bug bounty hunting. A well-organized repository of findings, methodologies, and technical reports enables efficient tracking and reproducible results.
Step-by-Step Guide:
Step 1: Create a Structured Repository
Create project structure
mkdir -p bug-bounty-recon/{targets,findings,reports,tools,scripts}
Organize by target
mkdir -p bug-bounty-recon/targets/{target1,target2,target3}
Create findings template
cat > bug-bounty-recon/findings/template.md << EOF
Vulnerability Report
Target
- URL:
- Date:
Description
Steps to Reproduce
Proof of Concept
Impact
Remediation
References
EOF
Step 2: Automate Report Generation
Create a simple reporting script
cat > bug-bounty-recon/scripts/generate_report.sh << 'EOF'
!/bin/bash
TARGET=$1
DATE=$(date +%Y%m%d)
echo " Bug Bounty Report - $TARGET" > "reports/${TARGET}<em>${DATE}.md"
echo " Subdomains Found" >> "reports/${TARGET}</em>${DATE}.md"
cat "targets/$TARGET/subdomains.txt" >> "reports/${TARGET}<em>${DATE}.md"
echo " Live Hosts" >> "reports/${TARGET}</em>${DATE}.md"
cat "targets/$TARGET/live_hosts.txt" >> "reports/${TARGET}<em>${DATE}.md"
echo " Vulnerabilities" >> "reports/${TARGET}</em>${DATE}.md"
cat "targets/$TARGET/findings.txt" >> "reports/${TARGET}_${DATE}.md"
EOF
chmod +x bug-bounty-recon/scripts/generate_report.sh
What Undercode Say:
- Documentation is the foundation of reproducibility — A well-documented reconnaissance process ensures that findings can be verified, reproduced, and built upon by the security community.
- Automation doesn’t replace creativity — While tools like Nuclei, Subfinder, and httpx automate repetitive tasks, the real challenge lies in identifying high-impact vulnerabilities through your own skills and creativity.
- Continuous learning is essential — The security landscape evolves rapidly, and maintaining an organized methodology allows researchers to adapt and improve their approaches over time.
- Open-source contributions strengthen the community — Sharing methodologies, tools, and findings helps elevate the entire bug bounty ecosystem and fosters collaborative security research.
- Ethical considerations must remain paramount — All reconnaissance activities must strictly follow the rules of engagement (RoE) and scope defined by respective bug bounty programs.
Prediction:
- +1 The increasing adoption of AI-powered reconnaissance tools will dramatically accelerate the discovery of vulnerabilities, enabling researchers to cover more attack surfaces in less time.
- +1 Open-source reconnaissance repositories will become the industry standard, creating a collaborative ecosystem where security researchers share methodologies and findings.
- +1 Automated reconnaissance pipelines will evolve to include real-time threat intelligence, allowing bug bounty hunters to prioritize high-value targets based on emerging attack patterns.
- -1 The democratization of advanced reconnaissance tools may lead to increased unauthorized scanning and potential legal implications for inexperienced researchers.
- -1 Organizations will need to invest significantly more in defensive monitoring to detect and respond to the sophisticated reconnaissance techniques employed by modern bug bounty hunters.
- +1 The integration of API and cloud security testing into standard reconnaissance workflows will uncover previously overlooked vulnerabilities in modern application architectures.
- +1 Machine learning-based anomaly detection in reconnaissance data will help researchers identify subtle patterns indicative of complex vulnerabilities that traditional tools might miss.
This article is based on industry-standard bug bounty methodologies and the open-source contributions of security researchers like Theekshana Kusal. Always ensure you have proper authorization before conducting any security testing on target systems.
▶️ Related Video (82% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Theekshana Kusal – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
