Basic recon methodology — from the domain to the vulnerable endpoints

Quick answer

Recon in bug bounty is the process of mapping the target's attack surface before you start auditing. Minimal pipeline: subdomains → live hosts → URLs → parameters → technologies. With free tools (subfinder, dnsx, httpx, katana, waybackurls, ffuf) you can map a target in 1-2 hours and expose forgotten endpoints that nobody audits.

Why recon matters

Hunters who only test app.target.tld compete with thousands of people. Those who map legacy.target.tld, staging-old.target.tld, internal.api.target.tld find flows nobody has touched in years.

Recon is the time multiplier: without it, you repeat the work a thousand people have already done on the main domain.

The 5-step pipeline

[Step 1] Subdomain enumeration
   ↓
[Step 2] Live host discovery
   ↓
[Step 3] URL crawling + historical
   ↓
[Step 4] Parameter discovery
   ↓
[Step 5] Tech fingerprinting + categorization

Step 1 — Subdomain enumeration

# Passive sources
subfinder -d target.tld -all -silent > subs.txt

# Extra passive (Chaos, AlienVault OTX, crt.sh)
chaos -d target.tld -silent >> subs.txt

# Manual passive
curl -s "https://crt.sh/?q=%25.target.tld&output=json" | jq -r '.[].name_value' | sort -u >> subs.txt

Combining 3-4 passive sources usually finds 30-50% more subdomains than a single one.

Step 2 — Live host discovery

# DNS resolution
dnsx -l subs.txt -silent -a -resp | tee resolved.txt

# HTTP probing
httpx -l subs.txt -silent -title -tech-detect -status-code -follow-redirects -o live.txt

Output: live subdomains with status code, title and detected stack. Useful for prioritizing (a subdomain that responds 200 with the title "Internal API Staging" is more interesting than one with 404).

Step 3 — URL crawling

# Active crawling
katana -list live.txt -d 3 -jc -o crawled.txt

# Historical (Wayback + commoncrawl + AlienVault)
cat live.txt | waybackurls > wayback.txt
cat live.txt | gau --threads 5 > gau.txt

# Combine and dedupe
cat crawled.txt wayback.txt gau.txt | sort -u > all_urls.txt

waybackurls and gau bring in historical URLs — endpoints that existed in the past and sometimes still live without being linked from anywhere.

Step 4 — Parameter discovery

# From historical URLs
cat all_urls.txt | unfurl format "%s://%d%p?%q" | grep "?" | sort -u > params.txt

# Parameter mining with Arjun (one per specific URL)
arjun -u https://api.target.tld/v1/users -m GET --stable

# Param-Miner (Burp extension) for hidden headers and backend parameters

Parameters that appear in wayback but not in the current version of the site are gold: the backend sometimes still processes them without them being documented.

Step 5 — Tech fingerprinting + categorization

# Detect tech stack
httpx -l live.txt -tech-detect -title -status-code -web-server -o tech.txt

# JS analysis to find internal endpoints + secrets
cat live.txt | hakrawler -d 2 -plain | grep '\.js$' > js_files.txt
cat js_files.txt | xargs -I{} curl -s {} | grep -oE 'https?://[^"]*' >> hidden_urls.txt

# Look for API keys in JS
cat js_files.txt | xargs -I{} curl -s {} | grep -E '(api[_-]?key|secret|token|password)' -i

SecretFinder and LinkFinder automate the search for endpoints and secrets in JS bundles.

Hunting patterns after recon

Once you have the map, prioritize:

Continuous recon

Programs that have been open for years are heavily audited. The difference is made by continuous monitoring:

• Daily subfinder cron → diff of subdomains → alert on new ones.
• Weekly httpx over live domains → detect status/title changes.
• GitHub watcher → monitor target.tld keywords in public commits.
• nuclei with specific templates over live hosts → scan for known vulns.

A vulnerability shipped 2 hours ago on a new, unaudited subdomain is easy €1,000 for whoever finds it first.

Minimal tools (free)

subfinder · dnsx · httpx · katana · gau · waybackurls
arjun · ffuf · nuclei · gf · hakrawler

They're all on ProjectDiscovery / GitHub. Install them with go install or pip.

Ethical recon — what NOT to do

• No DoS. Aggressive throttling on every tool (-rate 50 or less).
• Don't go out of scope. If the program says *.target.tld excluding customer.*, respect it.
• No auth bruteforce. Recon is passive enumeration, not an active attack.
• Don't put anything on the Internet (Burp Collaborator is fine for PoCs, but don't force real victims into induced hits).

Related labs

Practice the full recon pipeline on controlled targets: recon and enumeration labs.