The community
Inside people ask, share what they found and solve together what would block anyone on their own. It's free to join: no account, no plan, no email required.
Free and open. You don't need a BBLABS account to join.
Take your reconnaissance phase to the next level with advanced techniques for subdomain enumeration, JavaScript file analysis, GitHub dorking and automation.
BBLabs
Security Researcher
Stop reading about bugs and start hunting them
No card · free Academy · cancel anytime
The reconnaissance phase is where bounties are won or lost. Deep recon lets you discover forgotten assets, undocumented endpoints and attack surfaces that other hunters overlook. The golden rule is: the broader your attack surface, the higher your chances of finding vulnerabilities.
Passive sources give you subdomains without touching the target directly:
# Subfinder - queries multiple data sources
subfinder -d target.com -all -silent | sort -u > subs_subfinder.txt
# Amass - exhaustive enumeration with multiple techniques
amass enum -passive -d target.com -o subs_amass.txt
# crt.sh - SSL/TLS certificates (manual or with curl)
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
jq -r '.[].name_value' | sort -u > subs_crtsh.txt
Active sources interact with the target to discover subdomains that don't appear in public sources:
# Brute-force subdomains with a wordlist
ffuf -u "https://FUZZ.target.com" -w /path/to/subdomains.txt \
-mc 200,301,302,403 -o subs_bruteforce.txt
# DNS zone transfer (rare but worth trying)
dig axfr target.com @ns1.target.com
# Mass resolution to verify which subdomains exist
cat all_subs.txt | httpx -silent -status-code -title > alive_hosts.txt
cat subs_subfinder.txt subs_amass.txt subs_crtsh.txt subs_bruteforce.txt | \
sort -u > all_subdomains.txt
echo "[+] Total unique subdomains: $(wc -l < all_subdomains.txt)"
Don't limit yourself to the standard web ports (80/443). Many interesting services run on high ports:
# Nmap - full port scan
nmap -sS -p- --min-rate 1000 -T4 target.com -oN ports.txt
# Common interesting ports
# 8080, 8443 - Alternative web servers
# 3000 - Node.js / Grafana
# 8888 - Jupyter Notebook
# 9200 - Elasticsearch
# 6379 - Redis
# 27017 - MongoDB
JavaScript files are a gold mine. They contain API endpoints, tokens, keys and business logic:
# Extract URLs of JS files with gau and filter
gau target.com | grep "\.js$" | sort -u > js_files.txt
# Download and analyze JS files
while read url; do
curl -s "$url" >> all_js.txt
done < js_files.txt
# Look for API endpoints in the JS files
grep -oP '["'"'"']/api/[a-zA-Z0-9/_-]+' all_js.txt | sort -u
# Look for tokens and secrets
grep -iE '(api[_-]?key|secret|token|password|auth)\s*[:=]' all_js.txt
# LinkFinder - extracts endpoints from JS files
python3 linkfinder.py -i https://target.com/app.js -o cli
# SecretFinder - looks for secrets in JS files
python3 SecretFinder.py -i https://target.com/app.js -o cli
47 checks ordered by cost: first what can get you in trouble, then the cheap stuff, and finally the expensive stuff — which is where the big bounties are. I'll send it to your inbox right now.
Unsubscribe in one click, from any email.
GitHub is an incredible source of sensitive information. Developers make mistakes and publish credentials, internal endpoints and private documentation:
# Useful dorks in GitHub Search
"target.com" password
"target.com" api_key
"target.com" secret
org:targetorg filename:.env
org:targetorg filename:config extension:json
org:targetorg "BEGIN RSA PRIVATE KEY"
org:targetorg jdbc OR mysql OR postgresql
# truffleHog - searches for secrets in git repositories
trufflehog git https://github.com/target/repo
# gitdorker - automates GitHub dorks
python3 gitdorker.py -t TOKEN -org target -d dorks/medium.txt
The Internet Archive's Wayback Machine stores historical snapshots of websites. You can find old endpoints, deleted admin panels and sensitive files:
# waybackurls - get historical URLs
echo "target.com" | waybackurls | sort -u > wayback_urls.txt
# Filter by interesting extensions
cat wayback_urls.txt | grep -iE "\.(php|asp|aspx|jsp|json|xml|config|env|sql|bak|old|backup)"
# Look for potentially vulnerable parameters
cat wayback_urls.txt | grep "=" | qsreplace "FUZZ" | sort -u > params_to_test.txt
Knowing the target's technologies helps you look for specific CVEs and tailor your attacks:
# Wappalyzer CLI
wappalyzer https://target.com
# httpx with technology detection
echo "target.com" | httpx -tech-detect -status-code -title
# whatweb
whatweb https://target.com
The ultimate goal is to automate the whole recon process so you can run it periodically and detect changes:
#!/bin/bash
# recon-pipeline.sh
DOMAIN=$1
DATE=$(date +%Y%m%d)
DIR=~/recon/$DOMAIN/$DATE
mkdir -p $DIR
# Step 1: Subdomains
subfinder -d $DOMAIN -silent | sort -u > $DIR/subs.txt
amass enum -passive -d $DOMAIN >> $DIR/subs.txt
sort -u -o $DIR/subs.txt $DIR/subs.txt
# Step 2: Live hosts
cat $DIR/subs.txt | httpx -silent -status-code -title -tech-detect \
-o $DIR/alive.txt
# Step 3: URLs and parameters
cat $DIR/alive.txt | cut -d' ' -f1 | gau --threads 5 | sort -u > $DIR/urls.txt
# Step 4: Scan with Nuclei
nuclei -l $DIR/alive.txt -severity medium,high,critical \
-o $DIR/nuclei_results.txt
# Step 5: Diff against previous results
PREV=$(ls -d ~/recon/$DOMAIN/*/subs.txt 2>/dev/null | tail -2 | head -1)
if [ -n "$PREV" ]; then
diff $PREV $DIR/subs.txt | grep "^>" > $DIR/new_subs.txt
echo "[!] New subdomains found: $(wc -l < $DIR/new_subs.txt)"
fi
The best hunters don't run recon just once. They set up monitors that alert them when new subdomains appear or the infrastructure changes:
# Run your pipeline every 24 hours with cron
0 2 * * * /home/user/recon-pipeline.sh target.com
# Use services like Shodan Monitor or tools like notify
# to get alerts on Slack, Telegram or Discord
Advanced reconnaissance isn't about using more tools, but being more creative and systematic in how you look for information. Combine passive and active sources, analyze JavaScript files, search GitHub, leverage historical data and automate everything you can. The difference between finding a bug and missing it often lies in the depth of your recon.
hunters training
labs from real hacks
completions
paid out for these bugs
Create your free account and practice on labs based on real hacks that paid out thousands of euros. The Academy is free forever.
No card · free Academy · cancel anytime
A complete guide to getting started on HackerOne: from creating your account to submitting your first vulnerability report. Tips for beginners.
Google Dorks guide for bug bounty: what they are, the operators (site:, inurl:, intitle:, filetype:, ext:, intext:), ready-to-use examples for info exposure, panels, sensitive files and subdomains, ethical use within scope and how they fit into your recon.
ffuf tutorial: fuzzing directories, subdomains/vhosts and GET/POST parameters, how to filter noise with -fc/-fs and calibrate with -mc/-ac, SecLists wordlists and when to use gobuster or dirsearch as alternatives.