Listen to this Post
Introduction:
Reconnaissance, or recon, is the foundational phase of any successful bug bounty hunt or penetration test. It involves systematically gathering intelligence about a target to identify potential attack surfaces and hidden vulnerabilities that automated scanners often miss. Mastering a structured recon workflow is what separates amateur hunters from professional security researchers.
Learning Objectives:
- Understand the core principles and stages of a comprehensive bug bounty reconnaissance process.
- Learn and implement over 25 verified commands for subdomain enumeration, content discovery, and vulnerability probing.
- Develop a structured methodology to automate and execute a multi-layered recon approach.
You Should Know:
1. Subdomain Enumeration with `subfinder` and `amass`
`subfinder -d target.com -o subdomains.txt`
`amass enum -passive -d target.com -o amass_subs.txt`
`sort -u subdomains.txt amass_subs.txt > final_subs.txt`
Subdomain discovery is the critical first step. `subfinder` uses passive sources to find subdomains without sending traffic directly to the target. `amass` performs additional deep scraping and recursive brute-forcing. The `sort -u` command merges and deduplicates the results into a final list. Always start with passive enumeration to avoid triggering alarms before moving to more active techniques.
- Probing for Live Hosts and HTTP Services with `httpx`
`cat final_subs.txt | httpx -silent -tech-detect -title -status-code -ports 80,443,8080,8443 -o live_hosts.json`Not all subdomains are active. `httpx` quickly probes the list to identify which hosts are live and serving HTTP/HTTPS services. The flags `-tech-detect` identifies technologies (e.g., WordPress, React), `-title` fetches page titles, and `-status-code` records HTTP responses. This filters thousands of subdomains down to a manageable list of interesting targets for further analysis.
3. Content Discovery and Path Brute-Forcing with `ffuf`
`ffuf -w /path/to/wordlist.txt -u https://target.com/FUZZ -mc 200,301,302,403 -t 100`
`ffuf` is a blazing-fast web fuzzer. This command tests a target URL against a wordlist, replacing `FUZZ` with each word. The `-mc` flag filters for successful responses (200 OK), redirects (301, 302), and forbidden paths (403) which can sometimes be bypassed. A large wordlist like `raft-large-words.txt` is essential for uncovering hidden directories, API endpoints, and configuration files.
4. Discovering Endpoints from JavaScript Files with `LinkFinder`
`python3 LinkFinder.py -i https://target.com/script.js -o cli`
Modern web applications heavily rely on JavaScript. Often, JS files contain hardcoded API endpoints, keys, and internal paths. LinkFinder parses JavaScript files and extracts these endpoints from variables, strings, and comments. The `-i` flag specifies the input JS URL, and `-o cli` outputs the results to the command line. Always spider a site to download all JS files for analysis.
5. Parameter Discovery and Fuzzing for Injection Flaws
`ffuf -w /path/to/param_wordlist.txt -u https://target.com/endpoint?FUZZ=test -fs 0`
This `ffuf` command is fuzzing for parameters. It tests a list of common parameter names (e.g., id, user, file) against an endpoint. The `-fs 0` filter is used here to ignore responses of size 0, which are typically errors. Discovering parameters is the first step toward testing for critical vulnerabilities like SQL Injection, SSRF, and Local File Inclusion (LFI).
6. Screenshotting and Visual Recon with `gowitness`
`gowitness single https://target.com/login`
`gowitness scan –file live_hosts.txt`
Visual identification of interesting web applications is crucial. `gowitness` takes screenshots of web pages, allowing you to quickly visually review hundreds of hosts. The `single` command screenshots a single URL, while `scan` processes an entire file. This helps identify default login panels, development environments, and outdated web interfaces that are prime targets.
7. Automating the Masterflow with a Bash Script
!/bin/bash
domain=$1
echo "[+] Running reconnaissance on $domain"
subfinder -d $domain -o subfinder.txt
amass enum -passive -d $domain -o amass.txt
cat subfinder.txt amass.txt | sort -u > subs.txt
cat subs.txt | httpx -silent -tech-detect -title -ports 80,443,8080,8443 -o live.json
cat live.json | awk '{print $1}' | grep -oP 'https?://\K[^/]' > live_hosts.txt
gowitness scan --file live_hosts.txt
This bash script automates the entire initial recon process. Save it as recon.sh, make it executable with chmod +x recon.sh, and run it with ./recon.sh target.com. It sequentially runs subdomain enumeration, live host probing, and screenshotting, creating a reproducible and efficient workflow.
What Undercode Say:
- Reconnaissance is a non-negotiable, iterative process. Automation is key, but human analysis of the results is what leads to critical findings.
- The depth of your recon directly correlates with your bounty success. The researcher with the most complete target profile has the highest chance of finding the obscure vulnerability.
The provided “Masterflow” is less a revolutionary new technique and more a validation of the structured, layered approach that top bounty hunters have used for years. The real value isn’t in any single tool, but in the orchestration of multiple tools to leave no stone unturned. The future of recon lies in even greater automation, intelligence fusion (correlating recon data with GitHub leaks, certificate transparency logs, and archived data), and the use of machine learning to prioritize the massive amount of data generated. However, this also means defenders are automating their monitoring of these same noisy recon activities, making the need for slow, deliberate, and stealthy techniques more important than ever.
Prediction:
The automation and weaponization of reconnaissance will continue to accelerate. We will see the rise of AI-powered recon platforms that can not only gather data but also intelligently analyze it to autonomously hypothesize and test for complex vulnerability chains, fundamentally changing the bug bounty landscape from a human-driven search to a competition of automated agents.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Vinit Chaskar – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
