Listen to this Post
Introduction:
In the competitive world of bug bounty hunting, a thorough and automated reconnaissance phase is the cornerstone of success. This article deconstructs a powerful, multi-stage recon pipeline shared by security professionals, transforming a manual, time-consuming process into a streamlined, automated workflow that uncovers hidden attack surfaces and critical endpoints.
Learning Objectives:
- Construct a fully automated reconnaissance pipeline from passive enumeration to active endpoint discovery.
- Master the integration of cutting-edge, open-source tools from projects like ProjectDiscovery.
- Implement subdomain mutation and bruteforcing techniques to uncover hidden assets.
You Should Know:
1. Passive Subdomain Enumeration with Subfinder and Assetfinder
Verified Commands:
subfinder -d target.com -silent | tee subfinder.txt assetfinder --subs-only target.com | tee assetfinder.txt curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sed 's/\.//g' | sort -u | tee crtsh.txt amass enum -passive -d target.com -o amass.txt
Step‑by‑step guide:
This initial phase focuses on passively gathering subdomains without directly interacting with the target. `subfinder` and `assetfinder` query numerous public data sources and APIs. The `crt.sh` command extracts subdomains from SSL certificate transparency logs, a goldmine for discovery. `Amass` in passive mode consolidates these sources. The outputs are saved to individual files for consolidation.
2. Consolidating and Preparing Your Target List
Verified Commands:
cat subfinder.txt assetfinder.txt crtsh.txt amass.txt | sort -u | tee all_subs.txt cat all_subs.txt | httpx -silent | tee live_subs.txt
Step‑by‑step guide:
After gathering data from multiple sources, you must deduplicate and filter the results. The `cat` command combines all files, `sort -u` removes duplicates, and `tee` saves the final list. This consolidated list is then piped into httpx, a tool that probes the subdomains to check which are live (returning HTTP responses), drastically reducing the noise for subsequent steps.
3. Subdomain Bruteforcing and Permutation
Verified Commands:
puredns bruteforce /opt/seclists/Discovery/DNS/subdomains-top1million-5000.txt target.com --resolvers /opt/wordlists/resolvers.txt | tee bruteforce.txt gotator -sub all_subs.txt -perm /opt/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt -depth 1 -numbers 10 -md | sort -u | tee permutations.txt
Step‑by‑step guide:
Passive enumeration often misses obscure subdomains. `Puredns` performs a DNS bruteforce attack using a high-quality wordlist and trusted resolvers to bypass rate limiting. `Gotator` takes this further by generating permutations of already discovered subdomains (e.g., `api` -> api-dev, api-test, api1). The `-numbers` flag adds numerical permutations, uncovering development and staging environments.
4. Probing for Live Hosts and Web Services
Verified Commands:
cat permutations.txt bruteforce.txt | httpx -silent -threads 100 | tee final_live_subs.txt cat final_live_subs.txt | httpx -silent -ports 80,443,8080,8443,3000,5000,9000 | tee live_with_ports.txt naabu -list final_live_subs.txt -top-ports 1000 -silent | tee naabu_ports.txt
Step‑by‑step guide:
The newly discovered subdomains from bruteforcing and permutation must be probed to identify live web services. `Httpx` is used again with a higher thread count for speed. Additionally, probing for non-standard ports is crucial, as many applications run on ports like 3000, 5000, or 8080. `Naabu` is a fast port scanner that can be run in parallel to `httpx` to ensure maximum coverage.
5. Endpoint Discovery from Live Hosts
Verified Commands:
cat final_live_subs.txt | waybackurls | tee wayback_urls.txt cat final_live_subs.txt | gau | tee gau_urls.txt katana -list final_live_subs.txt -silent | tee katana_crawl.txt
Step‑by‑step guide:
With a finalized list of live hosts, the next step is endpoint discovery. `Waybackurls` and `Gau` (Go Waybackurls) fetch historical URLs from the Wayback Machine and Common Crawl, often revealing deprecated but still active endpoints and parameters. `Katana` is a fast, passive crawler that navigates the live site to discover links and endpoints in real-time, mimicking a user’s browsing behavior.
6. Filtering and Identifying Juicy Targets
Verified Commands:
cat wayback_urls.txt gau_urls.txt katana_crawl.txt | sort -u | grep -v ".woff|.css|.png|.jpg" | tee all_endpoints.txt cat all_endpoints.txt | grep "=" | qsreplace -a | tee all_params.txt cat all_endpoints.txt | uro | tee unique_endpoints.txt
Step‑by‑step guide:
The raw endpoint list will be noisy. This step filters out static files (images, fonts, stylesheets) using grep -v. `Grep “=”` isolates URLs with parameters, which are potential injection points. `Qsreplace` is used to add a marker (like FUZZ) into every parameter value for future fuzzing. `Uro` (URL Organizer) helps deduplicate URLs by filtering out same-path but different-parameter URLs, providing a clean, unique list.
- Automating the Entire Pipeline with a Bash Script
Verified Commands:
!/bin/bash if [ -z "$1" ]; then echo "Usage: ./recon_pipeline.sh <domain>" exit 1 fi DOMAIN=$1 echo "[+] Starting reconnaissance for: $DOMAIN" subfinder -d $DOMAIN -silent > subfinder.txt & assetfinder --subs-only $DOMAIN > assetfinder.txt & ... (Include all commands from above sections, running in parallel where safe) wait echo "[+] Recon pipeline complete. Check the output files."
Step‑by‑step guide:
To truly harness the power of this pipeline, automation is key. This bash script encapsulates all previous steps. By using the `&` operator, independent commands like `subfinder` and `assetfinder` are run in parallel, significantly speeding up the process. The `wait` command ensures the script pauses until all background jobs are complete before proceeding. Save this script, make it executable with chmod +x recon_pipeline.sh, and run it with your target domain.
What Undercode Say:
- Automation is Non-Negotiable: Manual recon cannot compete with the scale and consistency of a well-defined automated pipeline. This workflow ensures no stone is left unturned.
- The Power of Tool Chaining: The real magic lies not in a single tool, but in the seamless chaining of specialized utilities. Each tool’s output becomes the next tool’s input, creating a powerful, synergistic effect.
This pipeline represents a shift in modern bug bounty methodology. It systematizes the initial discovery phase, allowing hunters to dedicate more time to the complex analysis of potential vulnerabilities rather than the tedious work of finding them. By leveraging open-source tools from the ProjectDiscovery ecosystem and others, hunters can build a professional-grade reconnaissance system that continuously evolves with the community. The focus on permutation and bruteforce, combined with historical data, ensures coverage of both the obvious and the obscure parts of a target’s attack surface, directly leading to the discovery of critical, overlooked vulnerabilities.
Prediction:
The continued development and integration of AI-driven permutation engines and machine learning models for filtering noisy results will make reconnaissance pipelines even more precise and autonomous. We will see a move towards “smart recon” agents that can not only discover endpoints but also perform initial vulnerability classification, prioritizing targets for hunters based on historical exploit patterns and application context. This will further level the playing field, allowing less experienced hunters to find critical bugs while pushing elite hunters to develop even more advanced exploitation techniques.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Kartik Khetwani – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
