Listen to this Post
Introduction:
In the high-stakes world of bug bounty hunting and web application security, a structured and efficient reconnaissance process is the differentiator between finding nothing and uncovering critical vulnerabilities. This article deconstructs a professional-grade reconnaissance workflow, detailing the tools and methodologies used by security engineers to systematically map attack surfaces, discover hidden endpoints, and identify low-hanging security flaws.
Learning Objectives:
- Understand and implement a multi-stage reconnaissance pipeline from subdomain discovery to vulnerability testing.
- Master the command-line usage of essential open-source security tools for automation and efficiency.
- Learn to filter and prioritize targets from massive data sets to focus on viable attack vectors.
You Should Know:
1. Subdomain Enumeration & Live Host Discovery
The foundation of any web recon is discovering all associated assets. This involves finding subdomains and then filtering out inactive ones to target only live web servers.
Step‑by‑step guide explaining what this does and how to use it.
First, use multiple sources to cast a wide net. Then, probe for live HTTP/HTTPS services.
1. Enumerate subdomains using multiple tools subfinder -d target.com -silent > subfinder.txt assetfinder --subs-only target.com > assetfinder.txt amass enum -passive -d target.com -o amass.txt Combine and sort unique results cat subfinder.txt assetfinder.txt amass.txt | sort -u > all_subs.txt <ol> <li>Discover live hosts and web servers from the list httpx -l all_subs.txt -title -status-code -tech-detect -o live_hosts.txt
The `httpx` tool efficiently probes hosts, returning only live servers with valuable metadata like status codes and technologies used, which is crucial for the next steps.
2. Content Discovery & Directory Brute-Forcing
Once live hosts are identified, the next step is to discover hidden directories, files, and endpoints that often contain sensitive information, backup files, or administrative panels.
Step‑by‑step guide explaining what this does and how to use it.
Tools like Gobuster and Dirb use wordlists to guess potential paths.
Using Gobuster with the common seclists wordlist gobuster dir -u https://api.target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -t 50 -o gobuster_api.txt For a more extensive search, use a bigger list gobuster dir -u https://admin.target.com -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -x php,json,bak -t 100
The `-x` flag checks for extensions, and `-t` controls threads. Always adjust threads based on the target’s rate-limiting policies to avoid being blocked.
3. Parameter Discovery & Historical URL Mining
Finding parameters (like ?id=) is key for testing injection flaws. Historical data from archives can reveal deprecated but still functional endpoints with vulnerabilities.
Step‑by‑step guide explaining what this does and how to use it.
Combine current crawling with historical archives.
1. Crawl and extract parameters from a target python3 paramspider.py -d target.com --exclude woff,css,svg,png --output params.txt <ol> <li>Mine historical URLs from Wayback Machine echo "target.com" | waybackurls > wayback.txt Combine with Katana, a fast crawling tool katana -u https://target.com -d 5 -jc -kf -o katana_crawl.txt Merge, filter for interesting parameters, and deduplicate cat params.txt wayback.txt katana_crawl.txt | grep -E "(\?id=|\?uid=|\?q=|\?token=)" | sort -u > all_parameters.txt
4. Automated Vulnerability Scanning with Nuclei
Nuclei uses a vast community-powered template database to run thousands of checks for known CVEs, misconfigurations, and weaknesses against your target list.
Step‑by‑step guide explaining what this does and how to use it.
Run Nuclei on your live hosts for broad coverage, then on specific endpoints for critical issues.
Run with a subset of critical templates for speed nuclei -l live_hosts.txt -t ~/nuclei-templates/http/cves/ -t ~/nuclei-templates/http/misconfiguration/ -o nuclei_critical_findings.txt For a comprehensive, but slower, scan nuclei -l live_hosts.txt -severity low,medium,high,critical -o nuclei_full_scan.txt
Always update Nuclei templates (nuclei -ut) daily to have the latest checks. Prioritize findings by severity and manually verify them to avoid false positives.
5. Targeted Payload Testing for XSS & SQLi
Automated scanners provide a baseline, but targeted testing with specialized tools like Dalfox (XSS) and SQLMap (SQL Injection) on the discovered parameters is where critical bugs are often confirmed.
Step‑by‑step guide explaining what this does and how to use it.
First, test for Cross-Site Scripting (XSS), then for SQL Injection (SQLi).
1. XSS Testing with Dalfox on the parameter list cat all_parameters.txt | dalfox pipe --blind https://blindxss.site -o xss_results.txt <ol> <li>SQL Injection Testing with SQLMap (use with extreme caution and authorization) Test a single, high-potential endpoint sqlmap -u "https://target.com/profile.php?id=1" --batch --level=2 --risk=2 --dbs -o sqlmap_scan.log
CRITICAL NOTE: Only use SQLMap on targets you are explicitly authorized to test. Unauthorized use is illegal. For SSTI (Server-Side Template Injection), tools like `SSTImap` provide similar targeted assessment.
6. CORS & CSRF Configuration Testing
Misconfigurations in Cross-Origin Resource Sharing (CORS) and missing Cross-Site Request Forgery (CSRF) protections can lead to severe data theft and account compromise. These are often missed by generic scanners.
Step‑by‑step guide explaining what this does and how to use it.
Use manual browser testing combined with command-line checks for CORS.
Use curl to test for overly permissive CORS headers curl -H "Origin: https://evil.com" -I https://api.target.com/v1/userinfo | grep -i "access-control-allow-origin"
If the response includes `Access-Control-Allow-Origin: https://evil.com` or “, it’s misconfigured. For CSRF, manually inspect forms for anti-CSRF tokens or use browser extensions like “EditThisCookie” to test token validation by removing/altering the token and submitting the form.
7. Data Management: Deduplication & Prioritization
The recon process generates massive data. Efficient analysis requires deduplication, filtering for unique, interesting items, and prioritization based on technology and context.
Step‑by‑step guide explaining what this does and how to use it.
Use simple command-line filters to refine your lists.
Filter for unique, interesting JavaScript files that may contain secrets cat katana_crawl.txt wayback.txt | grep ".js$" | sort -u > all_js.txt Prioritize admin-related endpoints cat all_parameters.txt | grep -i "admin|auth|api|token|key|password|reset" > high_priority_endpoints.txt Remove false positives from live hosts (e.g., CDNs, parked domains) httpx -l live_hosts.txt -fr -title -status-code -mc 200,403,500 | grep -v "parking|cdn|cloudfront" > filtered_live_targets.txt
This final step ensures you spend time on targets with the highest potential reward.
What Undercode Say:
- Automation is King, but Context is Emperor: The true power of this workflow lies not just in running tools, but in the analyst’s ability to interpret results, connect findings, and understand the application’s business logic to chain low-severity issues into critical impacts.
- Ethical Rigor is Non-Negotiable: The tools mentioned, especially SQLMap and Dalfox, are incredibly powerful. Their use is strictly bound by legal authorization (e.g., bug bounty program scope, pentest contracts). Unauthorized testing is a criminal act.
- Analysis: This workflow exemplifies the modern security engineer’s approach: a blend of automation and manual craftsmanship. It moves from broad discovery (subdomains) through progressive focusing (live hosts, parameters) to targeted exploitation (XSS, SQLi). The most overlooked step is often the final data management phase. Without proper filtering, analysts drown in noise. The integration of historical data (WaybackURLs) is a force multiplier, often uncovering forgotten development endpoints that are riddled with vulnerabilities. Ultimately, this structured methodology transforms chaotic hacking into a repeatable, scalable engineering discipline, which is precisely what separates professional red teams and successful bug bounty hunters from script kiddies.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Furqan Ansari – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
