Automation Setup

The simplest pipeline: subdomains → live probe → preview. Three tools, one command, no temp files.

Domain to IP pipeline: batch subdomain enumeration → DNS resolution → unique IP list

Full recon one-liner: enumerate → probe → filter 404s → display AND save output simultaneously

Complete surface scan: subdomains → IPs → port scan — all without writing a single temp file

The golden pipeline: find subs → probe live → scan for vulns — the foundation of every automated workflow

JavaScript scanning pipeline: filter JS files from URL list → scan for API keys and secrets with Nuclei

Complete recon script: input domain, timestamped output directory, sequential enumeration, and vulnerability scanning

Make the script executable and run it against your target — outputs go to a timestamped folder

Batch mode: run the same recon script against every domain in your target list automatically

Script with error handling: check for duplicate runs, show progress after each phase with counter

Run the script and log everything to a file for debugging and audit trail

Modular script with function-based phases — timestamped logging for each phase with start/finish markers

Stage 1: parallel-ready pipeline design — each phase uses a dedicated subdirectory for clean output organization

Parallel execution pipe: subdomains → IP resolution → port scan in one memory-efficient pipeline

Stage 2: vulnerability scanning — focus on critical and high severity CVEs first for maximum impact

Stage 3: exposure scanning — check for open S3 buckets, debug pages, admin panels, and misconfigurations

Stage 4: misconfiguration scanning — find security header gaps, directory listing, and other common flaws

Report generation: merge all vulnerability files into a single deduplicated findings report

Quick summary: count total unique findings and display directly in terminal output

Send a notification via Telegram using ProjectDiscovery's notify tool — requires pre-configured provider

Pipe critical Nuclei findings directly to Telegram/Slack — instant alert when something important is found

Multi-channel alert script: Telegram + Slack + terminal bell when critical CVEs are detected in real-time

Send a formatted summary message at the end of a pipeline run — one digest instead of multiple alerts

Parse Nuclei JSON output with jq and send individual alerts per finding with severity and host info

Bulk notify: send all critical findings as a single message using a custom provider ID

Parallel subdomain enumeration across 32 cores — each domain gets its own subfinder+httpx pipeline

Parallel DNS resolution and HTTP probing — 50 subdomains processed simultaneously

xargs with 10 parallel processes — runs the recon script for 10 targets at once

Parallel full port scan with naabu — 100 ports at a time, completes a full 65535 scan in seconds

Parallel HTTP header fetcher — check response codes for 20 URLs simultaneously

Export a bash function and run it with GNU Parallel — full pipeline across 100 targets, 10 at a time

Parallel nmap with progress bar — shows real-time completion stats for each target being scanned

Auto-commit script: run recon and immediately commit results to local Git repository with timestamp

View the last 10 recon runs — each commit represents a full scan cycle with timestamp

Compare subdomains between today's scan and yesterday's — exactly what changed in the diff

See all new vulnerabilities found in the last week — grep only the additions in the diff

Push all recon results to a private GitHub repository — remote backup and team collaboration

Auto-push script: commit and push to remote after every scan cycle with automatic retry logic

Search across ALL historical scan data: find every admin panel that ever returned 200 across all targets

GitHub Actions workflow: scheduled nightly recon on GitHub's infrastructure — free, no server needed

Deploy a Google Cloud Function that runs subfinder — serverless HTTP-triggered recon

Trigger a serverless scan via HTTP POST — integrate into any pipeline with a simple curl call

Cloud Run container: single-purpose container with httpx — deploy as a stateless microservice

Deploy to Cloud Run with 4 CPUs, 8GB RAM, and 15-minute timeout — enough for large target lists

AWS Lambda deployment for subfinder — serverless recon in the AWS ecosystem with IAM role security

Run all CVE templates with live statistics — shows progress, found, and rate metrics in real-time

Run only critical and high severity templates — focus on the most impactful findings first

Filter results by HTTP status code — useful when looking for specific response patterns

JSON output format — machine-readable output for pipeline processing with jq and other tools

Rate-limited scan — 150 requests per second, 60 per minute to avoid WAF blocks

Batch scanning across multiple targets — 25 URLs per batch, 10 concurrent hosts

Format JSON results into a clean severity | name | host table for easy triage and reporting

Read an existing CVE template to understand the YAML structure: id, info, requests, and matchers sections

Custom template from scratch: checks for config.json files containing sensitive keywords like api_key or password

Run your custom template against a target to test it works before adding it to your template library

Multi-endpoint template: checks multiple paths in a single request block for common security-related files

Parameterized template with payload file — iterates over admin-paths.txt and stops on first match (200/403/401)

Run a custom template directory with workflow execution — templates in subdirectories run in sequence

Conditional workflow: runs cookie-grabber only if XSS is found, then session-hijack only if cookie is captured

Execute a workflow file — Nuclei processes templates in order with the defined conditions

Smart workflow: detect the technology first, then run ALL relevant CVE templates only if the technology is found

Multi-condition workflow: runs Heartbleed check only if port 443 is open AND weak ciphers are detected

Run an entire workflow directory against a target list — processes all .yaml files as individual workflows

Nuclei-based directory fuzzing — reads paths from a wordlist and checks for 200/403/401 responses

Run the fuzzing template with rate limiting (100 req/s) to avoid triggering WAFs

Parameter fuzzing template — injects parameter names from a wordlist and checks for error/exception responses

Read an existing brute-force template to understand the pattern — common for OAuth token and session testing

Organized template directory structure — categories mirror the official template repo for consistency

Create your first custom technology detection template — detect a specific CMS version by its unique path

Test all your custom templates against a known target in verbose mode — see exactly what matched and why

Chain workflow: detect the CMS first → automatically run all matching CVE templates if found

Validate ALL your templates for YAML syntax errors before using them in a real engagement

Deduplicate: skip findings from previous runs (-duc) so you only see NEW vulnerabilities

Shell aliases for common Nuclei operations — validate templates with ncv and scan with -duc via ncs

PR-triggered recon: scans only the files changed in a pull request for vulnerabilities — targeted and fast

Weekly full scan via GitHub Actions with artifact storage and failure notification

Trigger a workflow manually via GitHub CLI — useful for ad-hoc scans without opening the browser

View the last 5 workflow runs with their status and timestamps — monitor scan health from terminal

Auto-triage pipeline: after recon completes, auto-analyze findings and alert only on critical severity

Update the official template repo and run a full baseline scan — capture everything as your starting point

Analyze which templates trigger most often — identify the patterns that actually matter for your targets

Prune outdated templates (4+ year old CVEs) — they add noise and rarely apply to modern targets

Template curation script: extract only templates relevant to your targets (WordPress, Laravel, Apache, etc.)

Custom debug endpoint scanner — checks multiple debug paths and matches on known informational responses

Run only templates created by you (filter by author) — useful when testing newly written templates

Edit your cron jobs — opens the crontab file in your default editor (nano/vim)

Run recon pipeline every 6 hours — logs all output to a central file for debugging

Run vulnerability scan daily at 2 AM — off-peak hours for minimal target disruption

Full recon scan every Sunday at midnight — comprehensive weekly review of the target's attack surface

Check for new subdomains every 30 minutes — rapid detection of newly deployed assets

Generate a diff report every Monday at 6 AM — compares this week's results with last week's

Quick check: view the most recent critical findings and errors from your cron logs

Health check script: verify cron jobs are registered and the latest logs show recent activity

Create a systemd service unit — defines what command to run as a systemd-managed service

Create a systemd timer unit — schedules the service to run at 0/6/12/18 with randomized delay for stealth

Reload systemd, enable the timer to start on boot, and activate it immediately

Verify the timer is active — shows next run time, last run time, and status

Follow the service logs in real-time — useful for debugging pipeline execution

Filter service logs for the past hour — grep for important keywords in pipeline output

Dependency-based service: this scan runs AFTER the recon pipeline completes successfully

Dockerfile with all recon tools pre-installed — single image that contains your entire pipeline toolchain

Build the Docker image — downloads dependencies and installs all tools in a reproducible environment

Run the pipeline container — mounts a local output directory so results persist after the container exits

Docker Compose configuration — simplifies volume mounts and command arguments

Run via Docker Compose and clean up — containers are ephemeral, only results persist

Docker ignore file — prevents unnecessary files from being copied into the image, keeping it small

Change detection script: compare today's subdomains with yesterday's — find what changed

Formatted diff output — marks removed entries with [-] and new entries with [+] for clear reading

Simple bash loop: find subdomains in today's scan that weren't in yesterday's scan

Fast set comparison with comm — line 3 shows entries only in new-sorted.txt (requires sorted input)

grep-based set subtraction: find lines in new that don't exist in old — simple and effective

Alert on change detection: send an instant Telegram notification when a new high-value subdomain is found

Initial VPS setup: SSH into the server and update all packages to the latest versions

Create a dedicated user for recon operations — never run pipelines as root for security

Generate an Ed25519 SSH key and copy it to the VPS for passwordless authentication

SSH hardening: custom port (2222), disable root login and passwords, require key-based auth

Firewall: allow SSH on custom port, allow outbound HTTP/HTTPS, block everything else

Install Docker and add your user to the docker group so you can run containers without sudo

Install fail2ban to automatically block IPs with repeated failed SSH login attempts

Install all core recon tools on the VPS — run once during initial setup

Generate a self-contained HTML report with severity distribution stats — scp it to a web server for live viewing

Sort findings by severity — extract the severity label and sort descending so critical issues appear first

Severity distribution summary — count how many critical, high, medium, and low findings per scan run

Output Nuclei results in JSON format — machine-readable for programmatic processing and dashboarding

Parse JSON results into a clean aligned table with jq — severity, template name, and affected host

Trend analysis script: report total and weekly finding counts across all bug bounty targets

Install s3cmd (works with S3, DO Spaces, and MinIO) and run the interactive configuration wizard

Create a monthly bucket for recon results — each month gets its own bucket for organization

Sync local reports directory to cloud storage — uploads new files and removes deleted ones

Upload a compressed archive of scan results — tar.gz reduces storage by 80-90%

List the most recent files in cloud storage — verify uploads are working correctly

Daily archive script: compress, upload, and clean up — keeps VPS storage usage under control

Make specific results publicly accessible — useful for sharing findings with program teams or collaborators

Schedule automatic daily cloud backups — add to your existing cron-jobs.sh and never lose results

Docker Compose for Prometheus + Grafana — spin up a full monitoring stack in seconds

Prometheus scrape config — pull metrics from your recon metrics exporter running on port 8000

Prometheus metrics exporter — exposes subdomain count, live hosts, vulnerabilities, and disk usage as Prometheus metrics

Start the monitoring stack in detached mode — Prometheus on :9090, Grafana on :3000

One-command monitoring startup — launches the metrics exporter and the full monitoring stack

Verify the metrics exporter is working — should return current subdomain count, live hosts, vuln count, and disk usage

Create a Prometheus alert: sudden drop in subdomain count likely indicates data loss or scan failure