Advanced recon techniques

Why is recon so important?

The reconnaissance phase is where bounties are won or lost. Deep recon lets you discover forgotten assets, undocumented endpoints and attack surfaces that other hunters overlook. The golden rule is: the broader your attack surface, the higher your chances of finding vulnerabilities.

Subdomain enumeration

Passive sources

Passive sources give you subdomains without touching the target directly:

# Subfinder - queries multiple data sources
subfinder -d target.com -all -silent | sort -u > subs_subfinder.txt

# Amass - exhaustive enumeration with multiple techniques
amass enum -passive -d target.com -o subs_amass.txt

# crt.sh - SSL/TLS certificates (manual or with curl)
curl -s "https://crt.sh/?q=%.target.com&output=json" | \
  jq -r '.[].name_value' | sort -u > subs_crtsh.txt

Active sources

Active sources interact with the target to discover subdomains that don't appear in public sources:

# Brute-force subdomains with a wordlist
ffuf -u "https://FUZZ.target.com" -w /path/to/subdomains.txt \
  -mc 200,301,302,403 -o subs_bruteforce.txt

# DNS zone transfer (rare but worth trying)
dig axfr target.com @ns1.target.com

# Mass resolution to verify which subdomains exist
cat all_subs.txt | httpx -silent -status-code -title > alive_hosts.txt

Combining and deduplicating results

cat subs_subfinder.txt subs_amass.txt subs_crtsh.txt subs_bruteforce.txt | \
  sort -u > all_subdomains.txt

echo "[+] Total unique subdomains: $(wc -l < all_subdomains.txt)"

Port scanning

Don't limit yourself to the standard web ports (80/443). Many interesting services run on high ports:

# Nmap - full port scan
nmap -sS -p- --min-rate 1000 -T4 target.com -oN ports.txt

# Common interesting ports
# 8080, 8443 - Alternative web servers
# 3000 - Node.js / Grafana
# 8888 - Jupyter Notebook
# 9200 - Elasticsearch
# 6379 - Redis
# 27017 - MongoDB

Analyzing JavaScript files

JavaScript files are a gold mine. They contain API endpoints, tokens, keys and business logic:

# Extract URLs of JS files with gau and filter
gau target.com | grep "\.js$" | sort -u > js_files.txt

# Download and analyze JS files
while read url; do
  curl -s "$url" >> all_js.txt
done < js_files.txt

# Look for API endpoints in the JS files
grep -oP '["'"'"']/api/[a-zA-Z0-9/_-]+' all_js.txt | sort -u

# Look for tokens and secrets
grep -iE '(api[_-]?key|secret|token|password|auth)\s*[:=]' all_js.txt

Specialized tools for JS analysis

# LinkFinder - extracts endpoints from JS files
python3 linkfinder.py -i https://target.com/app.js -o cli

# SecretFinder - looks for secrets in JS files
python3 SecretFinder.py -i https://target.com/app.js -o cli

GitHub dorking

GitHub is an incredible source of sensitive information. Developers make mistakes and publish credentials, internal endpoints and private documentation:

# Useful dorks in GitHub Search
"target.com" password
"target.com" api_key
"target.com" secret
org:targetorg filename:.env
org:targetorg filename:config extension:json
org:targetorg "BEGIN RSA PRIVATE KEY"
org:targetorg jdbc OR mysql OR postgresql

Automation tools

# truffleHog - searches for secrets in git repositories
trufflehog git https://github.com/target/repo

# gitdorker - automates GitHub dorks
python3 gitdorker.py -t TOKEN -org target -d dorks/medium.txt

Wayback Machine

The Internet Archive's Wayback Machine stores historical snapshots of websites. You can find old endpoints, deleted admin panels and sensitive files:

# waybackurls - get historical URLs
echo "target.com" | waybackurls | sort -u > wayback_urls.txt

# Filter by interesting extensions
cat wayback_urls.txt | grep -iE "\.(php|asp|aspx|jsp|json|xml|config|env|sql|bak|old|backup)"

# Look for potentially vulnerable parameters
cat wayback_urls.txt | grep "=" | qsreplace "FUZZ" | sort -u > params_to_test.txt

Technology fingerprinting

Knowing the target's technologies helps you look for specific CVEs and tailor your attacks:

# Wappalyzer CLI
wappalyzer https://target.com

# httpx with technology detection
echo "target.com" | httpx -tech-detect -status-code -title

# whatweb
whatweb https://target.com

Building automation pipelines

The ultimate goal is to automate the whole recon process so you can run it periodically and detect changes:

#!/bin/bash
# recon-pipeline.sh
DOMAIN=$1
DATE=$(date +%Y%m%d)
DIR=~/recon/$DOMAIN/$DATE

mkdir -p $DIR

# Step 1: Subdomains
subfinder -d $DOMAIN -silent | sort -u > $DIR/subs.txt
amass enum -passive -d $DOMAIN >> $DIR/subs.txt
sort -u -o $DIR/subs.txt $DIR/subs.txt

# Step 2: Live hosts
cat $DIR/subs.txt | httpx -silent -status-code -title -tech-detect \
  -o $DIR/alive.txt

# Step 3: URLs and parameters
cat $DIR/alive.txt | cut -d' ' -f1 | gau --threads 5 | sort -u > $DIR/urls.txt

# Step 4: Scan with Nuclei
nuclei -l $DIR/alive.txt -severity medium,high,critical \
  -o $DIR/nuclei_results.txt

# Step 5: Diff against previous results
PREV=$(ls -d ~/recon/$DOMAIN/*/subs.txt 2>/dev/null | tail -2 | head -1)
if [ -n "$PREV" ]; then
  diff $PREV $DIR/subs.txt | grep "^>" > $DIR/new_subs.txt
  echo "[!] New subdomains found: $(wc -l < $DIR/new_subs.txt)"
fi

Continuous monitoring

The best hunters don't run recon just once. They set up monitors that alert them when new subdomains appear or the infrastructure changes:

# Run your pipeline every 24 hours with cron
0 2 * * * /home/user/recon-pipeline.sh target.com

# Use services like Shodan Monitor or tools like notify
# to get alerts on Slack, Telegram or Discord

Conclusion

Advanced reconnaissance isn't about using more tools, but being more creative and systematic in how you look for information. Combine passive and active sources, analyze JavaScript files, search GitHub, leverage historical data and automate everything you can. The difference between finding a bug and missing it often lies in the depth of your recon.