Hello, everyone! 👋

Reconnaissance (“Recon”) forms the backbone of any successful bug bounty-hunting process. It’s the phase where you gather information about the target to identify vulnerabilities effectively. This blog outlines a structured step-by-step recon methodology that provides a practical guide for security enthusiasts and bug hunters. Let’s dive in! 🚀

1. Scope Review 🌐

Before initiating reconnaissance, thoroughly review the target’s scope to ensure you focus on authorized assets. Understanding the boundaries prevents unintentional violations of the program’s rules.

Example Scope:

• Allowed assets: .target.com
• Excluded assets: Third-party services or subdomains outside .target.com

2. Subdomain Enumeration 🔍

Begin by identifying all possible subdomains of your target. Tools like BBOT provide a consolidated approach, integrating techniques like DNS brute-forcing and OSINT queries.

bbot -d target.com

Why BBOT? It’s a comprehensive tool for discovering subdomains using multiple methods efficiently.

3. Alive Subdomain Check 🔧

After enumeration, verify which subdomains are live using httpx:

cat subdomains.txt | httpx -silent -o alive_subdomains.txt

Why HTTPX? It quickly checks for active domains, streamlining your efforts during the initial recon stage.

4. Crawling Alive Subdomains 🔄

Crawl the active subdomains to extract endpoints using Katana:

katana -list alive_subdomains.txt -o endpoints.txt

Why Katana? Its speed and support for recursive crawling help uncover hidden endpoints efficiently.

5. Screenshotting 📸

Visualizing the collected subdomains allows you to spot interesting targets. Use Eyewitness for this:

eyewitness --web -f alive_subdomains.txt --threads 5 -d screenshots/

Why Eyewitness? It captures web application screenshots, making it easier to prioritize potential targets.

6. Automated Scanning (N-Qube) ▶️

Employ a combination of automated scanners for vulnerability detection:

6.1 Nuclei

Scan subdomains for known vulnerabilities using community-built templates:

cat alive_subdomains.txt | nuclei -t templates/ -o nuclei_results.txt

Why Nuclei? It offers a template-driven approach, saving time when identifying common vulnerabilities.

6.2 Nmap

Discover open ports and services:

nmap -sVC -T4 -iL alive_subdomains.txt -oN nmap_results.txt

Why Nmap? It’s an essential tool for detailed network reconnaissance.

6.3 Nikto

Identify web server misconfigurations:

nikto -h alive_subdomains.txt -output nikto_results.txt

Why Nikto? It complements other tools by detecting web server-specific vulnerabilities.

7. Technology Fingerprinting 🔎

Understand the technology stack using tools like Wappalyzer (browser extension) or services such as BuiltWith and WhatRuns.

Why Wappalyzer? It reveals CMS, frameworks, and libraries the target uses, offering insights into potential attack vectors.

8. Identifying Low-Hanging Fruits 🍎

Focus on easy-to-exploit vulnerabilities:

8.1 Subdomain Takeover

Detect unclaimed subdomains using Subzy:

subzy run --targets alive_subdomains.txt

Why Subzy? It automates subdomain takeover detection, which can uncover critical vulnerabilities.

8.2 Broken Link Hijacking

Identify broken links with SocialHunter:

socialhunter -f alive_subdomains.txt

Why SocialHunter? It simplifies finding exploitable broken links.

8.3 Cross-Site Scripting (XSS)

Test for XSS vulnerabilities with ParamSpider:

paramspider -d target.com | qsreplace '"/><script>alert(1)</script>' > xss.txt
cat xss.txt | while read url; do curl --silent --path-as-is --insecure "$url" | grep -qs "<script>alert(1)" && echo "$url Vulnerable" || echo "$url Not Vulnerable"; done

Why ParamSpider? It identifies hidden parameters that might be susceptible to injection attacks.

9. URL Gathering 🌐

Collect all URLs from your findings using tools like WaybackURLs and Gau:

cat alive_subdomains.txt | waybackurls | tee -a urls.txt
cat urls.txt | httpx -silent -o alive_urls.txt
cat alive_urls.txt | grep config

Why WaybackURLs and Gau? They extract historical endpoints, revealing forgotten but potentially exploitable URLs.

10. Google Dorking 🔮

Leverage Google search operators to find exposed sensitive information. Automate this with tools like Bug Bounty Search Engine.

Why Google Dorking? It’s an effective method to uncover publicly available but sensitive data.

11. GitHub Recon 💻

Search GitHub repositories for accidental exposures like API keys and credentials:

Example: Use GitHub’s search feature: "target.com".

Why GitHub Recon? It often reveals critical information inadvertently shared by developers.

Conclusion

This marks the end of Part 1 of the deep recon methodology. These steps lay the foundation for uncovering critical vulnerabilities. Stay tuned for Part 2, where we’ll explore advanced recon techniques.

If you found this guide helpful, share it with your peers and follow me for more updates. Happy hacking! 🔒💻