Recon automation

In bug bounty, recon is often what decides who finds the bug: the more surface you discover (and the sooner), the more opportunities you have on assets others don’t see. Automating recon lets you cover large targets and continuously monitor changes. (General theory in the recon area.)

The goal of recon in BB

- discover ALL the scope's surface: subdomains, apps, APIs, parameters, technologies
- find the FORGOTTEN: old subdomains, staging, acquisitions, exposed panels
- monitor CHANGES: new subdomains/endpoints = new opportunities (fewer eyes)

Typical pipeline (chained)

# 1. subdomains (passive + active)
subfinder -d target.com | tee subs.txt
amass enum -passive -d target.com >> subs.txt
# 2. which are alive? (resolve + probe HTTP)
cat subs.txt | sort -u | httpx -silent -title -tech-detect -status-code > live.txt
# 3. URL/endpoint discovery (historical + crawling)
gau target.com ; waybackurls target.com ; katana -u https://target.com
# 4. template scanning (known vulns/exposures)
nuclei -l live.txt -severity medium,high,critical   # see tool-nuclei

Discovery techniques

Passive   CT logs (crt.sh), DNS, search engines, archives (wayback) -> without touching the target
Active    subdomain/DNS brute force, resolution, HTTP probing
JS mining  parse JS files -> endpoints, keys, hidden routes (LinkFinder)
Favicon/hashes  identify technology/assets by favicon hash (Shodan/FOFA)
Content   ffuf/feroxbuster for hidden content and parameters (see tool-ffuf)

Continuous monitoring

- re-run recon periodically and DIFF: the NEW is the interesting part
- alerts for new subdomains/endpoints (cron + notification)
- frameworks: a pipeline that orchestrates the tools and keeps history
# whoever detects the change FIRST usually gets the bug

Tools

Subdomains   subfinder, amass, assetfinder, findomain
Probing      httpx, dnsx
URLs         gau, waybackurls, katana, hakrawler
Vulns        nuclei (templates, see tool-nuclei), ffuf (see tool-ffuf)
Orchestration  your own bash/python pipelines; avoid "black box" frameworks you don't understand

Blue Team / ethical note

Keep recon within scope (Reading the scope & rules): resolving/probing out of scope is a problem.
Prefer passive techniques first (less noise and risk) and active ones with care.
The competitive edge is continuous monitoring + diff: detect the new first.
Understand your tools; don’t fire frameworks you don’t control at real targets.

Best practices and common mistakes

Broad, continuous recon (subdomains, staging, JS) is where the highest-impact bugs come from.
Monitor for changes (new subdomains and endpoints) continuously, not in a single pass.
Common mistake: verifying a subdomain takeover destructively; prove it minimally without breaking anything.

Testing checklist

Enumerate subdomains (passive + active) within scope
Resolve and probe HTTP (httpx: title, tech, status)
Discover URLs/endpoints (gau/wayback/katana + JS mining)
Template scanning (nuclei) of exposures/vulns
Fuzzing of hidden content/parameters (ffuf)
Look for subdomain takeover and forgotten assets
Continuous monitoring + diff of the new