Complete recon — subdomains, fingerprinting, ASN and origin IPs

Quick answer

Recon is 70% of bug bounty. The methodology that works: passive (subfinder + amass passive + assetfinder + wayback) → active (puredns bruteforce + ffuf vhosts) → probe (httpx alive) → fingerprint (naabu + wafw00f + JS files) → ASN expansion (amass intel + masscan). Close the loop with git history mining (TrashCash) for secrets removed from the target's public repos.

Subdomain enumeration

Two passes: passive first (fast, doesn't touch the target) and active afterward (bruteforce with a wordlist).

Passive

subfinder -d target.com -o subs.txt
amass enum -passive -d target.com -o amass_subs.txt
assetfinder --subs-only target.com >> subs.txt

Active

puredns bruteforce wordlist.txt target.com -r resolvers.txt -w active_subs.txt

Merge + probe alive

cat subs.txt amass_subs.txt active_subs.txt | sort -u > all_subs.txt
cat all_subs.txt | httpx -o alive.txt

[!tip] Quality wordlists n0kovo_subdomains_huge.txt (3M entries) is the sweet spot. For large targets: combine with commonspeak2-subdomains.txt (Assetnote). Fresh resolvers from the janmasarik/resolvers repo.

API recon

Endpoints exposed in documentation

Google dorking

site:target.com inurl:api
site:target.com filetype:json
site:target.com inurl:graphql
"api_key" OR "apikey" OR "api-key" site:target.com

Endpoint fuzzing

ffuf -u https://api.target.com/FUZZ -w /path/to/api-wordlist.txt -mc 200,301,302,403

Fingerprinting

Port scan

naabu -l subs.txt -top-ports 1000 -o ports.txt
nmap -sV -sC -p- target.com

WAF detection

wafw00f https://target.com

Headers to watch manually:

Origin IP behind the WAF

When everything is protected by Cloudflare/Akamai, finding the real origin IP usually exposes unfiltered endpoints:

hakoriginfinder -h target.com

Hash search:

shodan search "ssl.cert.subject.cn:target.com"
shodan search "http.favicon.hash:<hash>"

[!warning] Verification Never assume a candidate IP is the origin — always validate with curl -H "Host: target.com" https://CANDIDATE_IP/ and compare the content. False positives abound.

ASN mapping for large targets

For programs with scope *.target.com + their own infra (Coinbase, Tesla, GitLab), the ASN gives you ALL the IPs registered to that organization.

Reverse Whois

amass intel -whois -d target.com

ASN enumeration

whois -h whois.radb.net -- '-i origin AS<number>' | grep route
amass intel -asn <ASN_NUMBER>

Brute force IPs

masscan -p80,443,8080,8443 <IP_RANGE> --rate=10000 -oL scan_results.txt

Then httpx to identify what responds and aquatone for batch screenshots.

Virtual hosts

If an IP responds to multiple vhosts (common in shared infra), bruteforcing the Host header exposes applications not reachable via public DNS:

ffuf -u http://<IP>/ -H "Host: FUZZ.target.com" -w vhosts-wordlist.txt -fs <default-size>

-fs <default-size> filters the default response size — valid vhosts usually have a different size.

Git history mining — TrashCash

Mining the commit history of the target's public repos to find deleted files that contained secrets. The TrashCash technique (amrelsagaei.com) has produced $1000-$5000 bounties multiple times.

Workflow

git clone https://github.com/target/repo.git && cd repo

# List ALL deleted files
git log --diff-filter=D --summary | grep "delete mode"

# Recover the content of a deleted file
git show <commit-hash>:<path>

# Search for secrets across the ENTIRE history
trufflehog git file://. --json
gitleaks detect --source . -v

[!success] Why it works Developers delete accidentally committed credentials but the previous commit is still there — the secrets are still valid in production weeks later. Hunting .env, .aws/credentials, config.json, *.pem in the history is infinite low-hanging fruit.

Hunting checklist

• Passive: subfinder + amass passive + assetfinder + wayback
• Active: puredns with a huge wordlist + fresh resolvers
• httpx probe → alive.txt
• aquatone batch screenshots
• naabu top-1000 + nmap full-port on critical candidates
• wafw00f to identify protection
• LinkFinder on all .js of alive hosts
• Shodan/Netlas by SSL cert CN + favicon hash
• ASN expansion if the scope includes *.target.com
• vhosts bruteforce on detected IPs
• Target's public repos: TrashCash on each one

Related labs

Practice complete recon in an environment that simulates real infra (subdomains + WAF + ASN scope) with Recon labs.