Recon Flow

Subdomain enumeration, port scanning, technology fingerprinting, and endpoint discovery — the foundation of every bounty

1CHAPTER 1

Subdomain Enumeration & Asset Discovery

Map the target's entire digital footprint before you attack

Subdomain enumeration is the first and most critical step in any bug bounty engagement. The more assets you find, the larger your attack surface. Start passive to stay under the radar, then go active to uncover hidden gems. Combine multiple sources and tools — no single tool finds everything.

Passive Reconnaissance

Passive techniques gather subdomains without touching the target's servers. Start here — it's silent, fast, and often reveals 60-70% of all subdomains. Certificate Transparency logs, DNS dataset dumps, and search engines are your best friends. Combine multiple passive tools — each one queries different sources and no single tool catches everything.

subfinder -d example.com -o passive-subs.txt

Passive subdomain enumeration using 30+ sources (CT logs, DNS dumps, search engines, APIs)

subfinder -d example.com -all -o all-passive.txt

Enable all passive sources including slower APIs (Shodan, Virustotal, SecurityTrails)

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u

Query Certificate Transparency logs directly for all issued certificates on the domain

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > crtsh-subs.txt

Same as above but filter out wildcard entries for a cleaner subdomain list

findomain --target example.com --output

Fast passive subdomain discovery using Certificate Transparency, AnubisDB, and other sources

assetfinder --subs-only example.com > assetfinder-subs.txt

Simple passive subdomain discovery using various sources including crt.sh and DNS

cat passive-subs.txt | dnsx -silent -o live-subs.txt

Validate discovered subdomains — only keep those that resolve to an IP address

cat *.txt | sort -u | grep -E '^[a-zA-Z0-9.-]+\.example\.com$' > all-passive-unique.txt

Merge all passive sources into one deduplicated and filtered list

chaos -d example.com -key $CHAOS_KEY -o chaos-subs.txt

Fetch subdomains from ProjectDiscovery's Chaos dataset — curated passive dataset updated daily

curl -s 'https://api.securitytrails.com/v1/domain/example.com/subdomains' -H 'APIKEY: YOUR_KEY' | jq -r '.subdomains[]' | awk '{print $0".example.com"}' > securitytrails-subs.txt

SecurityTrails API — excellent passive source with historical subdomain data

TIPS

Set up API keys for subfinder: export the keys in your shell config for better coverage (Shodan, Virustotal, SecurityTrails, Censys)
Certificate Transparency is the single most reliable passive source — always run crt.sh independently
Run passive enumeration in the background while you work on other parts of the engagement
Merge ALL passive outputs before moving to active — you'll get 30-40% more subs by combining tools
Create a shell script that runs all passive tools sequentially and merges the output automatically

Certificate Transparency & SSL Analysis

Certificate Transparency logs are the richest passive source for subdomain discovery. Every time an organization issues an SSL certificate, the domain is logged in a public CT log. Beyond subdomain enumeration, SSL certificates reveal expiration dates, issuer details, alternate domain names (SANs), and often expose staging/dev certificates that aren't in any DNS wordlist.

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u > crtsh-all.txt

Full CT log dump from crt.sh — the most comprehensive free CT source

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sed 's/\*\.//g' | anew subs-found.txt

Strip wildcard prefixes and append only new subdomains to your master list

tlsx -san -cn -host example.com -o tlsx-output.txt

Fast TLS certificate enumeration — extract SANs (Subject Alternative Names) and CNs from certificates

echo example.com | tlsx -san -cn -so -o cert-domains.txt

TLS certificate subject output — captures every domain name listed in the certificate

openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -text | grep -A1 'Subject Alternative Name' | tr ',' '\n' | sed 's/^ *//' | awk '{print $1}' | sed 's/DNS://g' | sort -u

Manual SSL inspection — extract SANs using raw OpenSSL when tools aren't available

curl -s 'https://certspotter.com/api/v0/certs?domain=example.com' | jq -r '.[].dns_names[]' | grep 'example.com' | sort -u > certspotter-subs.txt

CertSpotter API — another CT source that sometimes finds domains crt.sh misses

curl -s 'https://api.certspotter.com/v1/issuances?domain=example.com&include_subdomains=true&expand=dns_names' | jq -r '.[].dns_names[]' | grep 'example.com' | sort -u

CertSpotter with include_subdomains — catches wildcard certificate SANs

python3 -c "import ssl, socket; cert = ssl.get_server_certificate((('example.com', 443))); print(cert)" | openssl x509 -text -noout | grep 'Subject:'

Python SSL extraction — useful in scripts for automated certificate collection

TIPS

Search for SANs (Subject Alternative Names) — they often contain internal services, subdomains, and dev portals
Check for expired certificates — they sometimes list domains that are no longer monitored but still accessible
Use tlsx for bulk scanning — it's much faster than OpenSSL when processing hundreds of domains
CertSpotter often catches certificates that crt.sh misses because it queries a different set of CT logs

Active Enumeration

Active techniques send requests to DNS servers and brute-force common subdomain patterns. Use these after passive recon to catch what passive missed — especially internal subdomains, dev environments, and staging servers. Active enumeration is louder but finds subdomains that no passive source has ever indexed.

puredns bruteforce subdomains-top1million-5000.txt example.com -r resolvers.txt -o active-subs.txt

Brute-force subdomains using a wordlist with wildcard filtering and mass DNS resolution

shuffledns -d example.com -list subdomains-top1million-5000.txt -r resolvers.txt -o found.txt

High-performance DNS bruteforce using shuffledns (faster than puredns for smaller wordlists)

dnsx -d example.com -a -aaaa -cname -ns -mx -soa -resp -o dns-records.txt

Enumerate all DNS record types for the root domain — uncover mail servers, nameservers, and more

puredns resolve subs-to-resolve.txt -r resolvers.txt -w wildcard-detect.txt

Resolve all collected subdomains with wildcard detection to filter out garbage DNS wildcard responses

amass enum -d example.com -o amass-output.txt -config config.ini

OWASP Amass — deep active enum with ASN lookup, reverse DNS, and certificate scraping (takes time but thorough)

amass enum -d example.com -passive -o amass-passive.txt

Amass passive mode — useful when you want Amass's sources without the aggressive active scanning

dnsx -d example.com -a -resp -silent > resolved-ips.txt && cat resolved-ips.txt | awk '{print $NF}' | sort -u > target-ips.txt

Resolve root domain IPs — gives you a starting IP list for port scanning

dnsx -l all-subs.txt -a -resp-only -silent -o all-ips.txt

Mass resolve all subdomains to IPs for port scanning in chapter 2

TIPS

Use a curated resolvers list (resolvers.txt) — fetch one from ProjectDiscovery's trusted list on GitHub
Wordlist quality matters more than quantity: subdomains-top1million-5000.txt is an excellent starting point
Run active enumeration during off-peak hours to avoid rate limiting and WAF triggers
Amass is slow but thorough — run it in the background while you work on other parts of recon
Always resolve subdomains to IPs — you need both for the next phases

ASN & IP Range Discovery

Every organization owns specific IP ranges and ASNs. Finding the full IP space gives you access to all self-hosted services — not just those mapped to subdomains. Use ASN lookup, BGP tools, and reverse WHOIS to map the target's complete network footprint.

whois -h whois.radb.net -- '-i origin AS12345' | grep -Eo '([0-9]+\.){3}[0-9]+/[0-9]+' | sort -u

Query RADB for all IP ranges announced by a specific ASN — reveals the full network block

whois -h whois.arin.net 'n AS12345' | grep -Eo '([0-9]+\.){3}[0-9]+/[0-9]+' | sort -u

ARIN WHOIS query for IP ranges associated with an ASN — complementary to RADB

curl -s 'https://api.bgpview.io/asn/AS12345/prefixes' | jq -r '.data.ipv4_prefixes[].prefix' > asn-ranges.txt

BGPView API — modern, fast ASN prefix enumeration without whois dependencies

curl -s 'https://api.bgpview.io/asn/AS12345/peers' | jq -r '.data.peers[].asn' > peer-asns.txt

Find peer ASNs — sometimes the target uses CDNs or partners that extend the attack surface

amass intel -asn AS12345 -o amass-asn-nets.txt

Amass ASN intelligence — fetches all netblocks for the given ASN with WHOIS data

cat asn-ranges.txt | naabu -top-ports 100 -o asn-open-ports.txt

Rapid port scan across all discovered IP ranges — identifies exposed services on the network block

curl -s 'https://ipinfo.io/AS12345' | grep -oP '([0-9]+\.){3}[0-9]+/[0-9]+' | sort -u

IPinfo ASN lookup — another reliable source for IP range discovery

TIPS

Identify the target's ASN by resolving any of their IPs: whois -h whois.radb.net '8.8.8.8' and look for origin AS
Large organizations often have multiple ASNs — check all of them for complete coverage
Scanning the full IP range often reveals staging/dev servers that aren't linked from the main DNS
Peer ASNs sometimes belong to third-party vendors hosting the target's infrastructure

Reverse DNS & PTR Records

Reverse DNS lookups convert IP addresses back to hostnames. This technique discovers servers that have PTR records but no forward DNS entry — meaning they exist but won't show up in any subdomain enumeration. This is particularly effective for cloud-hosted targets.

dnsx -l all-ips.txt -ptr -resp-only -o ptr-records.txt

Bulk PTR lookup on all discovered IPs — reveal hostnames that don't have forward DNS

cat all-ips.txt | while read ip; do dig +short -x $ip; done | grep 'example.com' > ptr-matches.txt

Traditional reverse DNS lookup using dig — filter results that belong to the target domain

nmap -sL -n 192.168.0.0/24 | grep '(' | awk '{print $5}' | tr -d '()' | grep 'example.com'

Nmap reverse DNS scan across an IP range — discovers hostnames on the entire netblock

curl -s 'https://sonar.omnisint.io/reverse/8.8.8.8' | jq '.'

Omnisint reverse DNS lookup API — quick check without installing tools

TIPS

PTR records often expose internal naming conventions, server roles, and data center locations
Run reverse DNS after ASN discovery — scan the full IP ranges, not just resolved subdomain IPs
Cloud targets (AWS, GCP, Azure) often have PTR records that reveal instance IDs and regions

Permutation & Alteration

Subdomain permutations generate variations of known subdomains using common patterns (wildcard→wildcard-api, dev→dev-api, staging→staging-old). This technique finds subdomains that no wordlist would ever contain. Feed discovered subdomains into permutation generators and re-run validation — each pass reveals more assets.

alterx -list found-subs.txt -o permutations.txt

Generate permutation mutations from known subdomains using common patterns and prefixes

alterx -list found-subs.txt -o permutations.txt -enrich

Enriched permutation generation — adds more mutation patterns for deeper coverage

puredns resolve permutations.txt -r resolvers.txt -o perm-resolved.txt

Resolve all generated permutations to find new live subdomains

gotator -sub found-subs.txt -perm permutations.txt -depth 1 -numbers 5 -mindup -adv -silent | sort -u > gotator-output.txt

Advanced permutation generator with depth control and duplicate prevention

gotator -sub found-subs.txt -perm wordlist.txt -depth 2 -numbers 10 -mindup -silent | sort -u > deep-permutations.txt

Deep permutation with numbers 0-9 on found subdomains — finds variations like dev-api-02

regulator -l found-subs.txt -o regulator-perms.txt

Regex-based subdomain permutation generator from Tom Hudson — pattern extraction and mutation

puredns resolve regulator-perms.txt -r resolvers.txt -o extra-subs.txt

Resolve regulator-generated permutations to validate new discoveries

cat perm-resolved.txt extra-subs.txt | sort -u > all-perm-subs.txt

Merge all permutation results for the next pipeline step

TIPS

Feed permutation results back into the pipeline — run subfinder and httpx on newly discovered subdomains
Use -numbers flag in gotator to generate numeric variations (dev01, dev02, staging-backup-01)
Permutations are especially effective for finding staging, dev, and backup servers
Run multiple permutation rounds — discovered subs in round 1 become input for round 2
The most valuable permutations often involve adding environment prefixes: dev-, stage-, test-, uat-

Subdomain Takeover Detection

Subdomain takeover occurs when a DNS CNAME points to a cloud service (AWS S3, GitHub Pages, Heroku, etc.) that is no longer in use. An attacker can register the unclaimed resource and serve content on the target's domain. This is a high-severity finding that must be checked on every engagement.

nuclei -l all-subs.txt -tags takeover -o takeover-results.txt

Nuclei takeover detection — runs 100+ templates targeting AWS, Azure, GCP, GitHub, and more

subjack -w all-subs.txt -t 100 -timeout 10 -o subjack-results.txt -ssl

Classic subdomain takeover scanner with SSL support — checks services, CNAMEs, and fingerprints

subjack -w all-subs.txt -t 50 -timeout 10 -o subjack-verbose.txt -v

Subjack in verbose mode — shows which services are checked and why they passed/failed

httpx -l all-subs.txt -status-code -cdn -o httpx-cdn.txt && cat httpx-cdn.txt | grep -E 'cloudfront|akamai|azureedge|s3.amazonaws' > cdn-check.txt

Filter subdomains pointing to CDN/cloud services to manually inspect for claimable resources

cat all-subs.txt | dnsx -cname -resp-only | grep -iE 's3\.amazonaws|cloudfront|azureedge|heroku|github\.io|pantheon|wordpress\.com|squarespace' > potential-takeovers.txt

Check DNS CNAME records directly for known unclaimed service patterns

curl -s -I 'http://subdomain.example.com' | grep -i 'Server:'

Check HTTP response headers for cloud service indicators (e.g., Server: AmazonS3, CloudFront)

TIPS

Focus on subdomains returning 404 (NXDOMAIN for CNAME target) — they're the most likely to be takoverable
AWS S3 bucket takeovers are the most common — always check S3 CNAMEs first
Not all cloud CNAMEs are vulnerable — verify by trying to register the resource before filing a report
Some services (like GitHub Pages) require the CNAME to exactly match a repo name — check this manually

Validation & Sorting

Not all subdomains are useful. Filter for HTTP/HTTPS services, identify technologies, and categorize by response behavior. This step separates the gold from the noise. Always run httpx with multiple flags in one pass to avoid re-scanning the same subdomains repeatedly.

cat all-subs.txt | httpx -silent -o live-urls.txt

Probe all subdomains for HTTP/HTTPS services and return only live URLs

cat all-subs.txt | httpx -silent -title -tech-detect -status-code -o enriched.txt

Enrich live subdomains with page titles, technology stack, and HTTP status codes

cat all-subs.txt | httpx -silent -content-length -web-server -response-time -o detailed.txt

Deep probe — capture response metadata for fingerprinting and comparison

cat enriched.txt | grep -E '301|302|401|403' > redirects-and-restricted.txt

Filter for interesting HTTP responses — redirects and restricted pages are prime targets

cat all-subs.txt | httpx -silent -ports 80,443,8080,8443,8000,3000,9090,4443 -o live-multi-ports.txt

Multi-port probing — some services run on non-standard web ports, httpx will check all of them

cat all-subs.txt | httpx -silent -title -status-code -tech-detect -follow-redirects -o enriched-redirects.txt

Follow redirects during probing — catch domains that redirect to different hosts or use path forwarding

cat enriched.txt | grep -vE '200|301|302' > non-standard-responses.txt

Flag non-standard responses (500, 403, 401, 503) for early vulnerability triage

Keyword filter enriched output for high-value endpoints like admin panels and login pages

Detect CMS-based targets — each CMS has its own set of known vulnerabilities and attack techniques

TIPS

Group output by subdomain source (passive vs active) so you can identify which techniques work best
401/403 pages often hide unprotected functionality — mark them for deeper inspection
Check for subdomain takeover: httpx with -cdn flag detects unclaimed cloud resources
Run validation after every subdomain discovery round — don't wait until the end
Use the enriched output to prioritize: 200 + interesting title + known technology = high value target

TOOLS IN THIS CHAPTER

subfinder

Fast passive subdomain enumerator from ProjectDiscovery with 30+ sources

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

amass

OWASP's comprehensive attack surface mapping tool — passive and active enumeration with ASN lookups

go install -v github.com/owasp-amass/amass/v4/...@master

findomain

Fast subdomain enumerator using Certificate Transparency, AnubisDB, and other passive sources

Can be downloaded from https://github.com/Findomain/Findomain/releases

assetfinder

Simple passive subdomain finder from Tom Hudson — good for quick passive validation

go install -v github.com/tomnomnom/assetfinder@latest

chaos

ProjectDiscovery's curated subdomain dataset from millions of CT logs updated daily

go install -v github.com/projectdiscovery/chaos-client/cmd/chaos@latest

tlsx

Fast TLS certificate enumerator — extracts SANs, CNs, and certificate metadata from live hosts

go install -v github.com/projectdiscovery/tlsx/cmd/tlsx@latest

puredns

High-performance DNS resolver with wildcard filtering and bruteforce

go install -v github.com/d3mondev/puredns/v2@latest

shuffledns

Massive-scale DNS bruteforce tool from ProjectDiscovery

go install -v github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest

dnsx

Multi-purpose DNS toolkit for record enumeration and resolution

go install -v github.com/projectdiscovery/dnsx/cmd/dnsx@latest

alterx

Subdomain permutation generator with pattern-based mutations

go install -v github.com/projectdiscovery/alterx/cmd/alterx@latest

gotator

Advanced permutation generator with depth control, numeric variations, and dedup

go install -v github.com/Josue87/gotator@latest

httpx

HTTP probing toolkit — validates, fingerprints, and enriches live endpoints

go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest

subjack

Subdomain takeover scanner — checks CNAMEs for unclaimed cloud resources

go install -v github.com/haccer/subjack@latest

▶

By the end of this phase, you should have a comprehensive list of live subdomains enriched with technology fingerprints and HTTP metadata. Feed everything into chapter 2 for port-level scanning.

2CHAPTER 2

Port Scanning & Service Identification

Every open port is a potential entry point — find them all

Port scanning reveals every service running on your target's infrastructure. The goal is not just to find open ports, but to identify service versions, operating systems, and misconfigurations — all without triggering alerts. Choose your scanner based on scope: masscan for the full internet view, naabu for speed, nmap for depth.

High-Speed Port Discovery

Begin with wide scans to identify all open ports across your target range. Speed matters here — you want results fast so you can focus on interesting services. Use masscan for large IP ranges, naabu for focused target lists. Always start with the top 100-1000 ports before going full port range.

naabu -list live-ips.txt -top-ports 100 -o open-ports-100.txt

Quick initial scan — top 100 ports covers the most common services in under 30 seconds per host

naabu -list live-ips.txt -top-ports 1000 -o open-ports.txt

Scan the top 1000 ports across all live IPs — fast, reliable, and CDN-aware

naabu -list live-ips.txt -p - -exclude-ports 80,443 -rate 1500 -o full-scan.txt

Full 65535 port scan excluding web ports — catch non-standard services hiding on high ports

masscan -p1-65535 --rate=10000 --output-format grepable --output-file masscan.out 192.168.1.0/24

Masscan the entire subnet at 10k packets/sec — use with caution and only with permission

masscan -p80,443,8000-8100,9000-10000 --rate=5000 -iL ip-ranges.txt -oJ masscan-web.json

Targeted masscan for web ports only — high-speed scan of non-standard web ports across IP ranges

rustscan -a target.com --ulimit 5000 -g -- -A -sC

RustScan wrapper: ultra-fast discovery then auto-pipes results into nmap for service enumeration

rustscan -a ips.txt --scan-order Random --grepsable -b 1500 -t 2000 -- -sV

RustScan batch mode — random scan order with custom batch size and timeout settings

zmap -p 443 -i eth0 -w ip-ranges.txt -o https-servers.txt

ZMap single-port scan across an IP range — useful for finding all HTTPS servers in a netblock

cat nmap-output.gnmap | grep 'open' | awk '{print $2}' | sort -u > live-hosts.txt

Extract live hosts from nmap grepable output for focused deeper scanning

TIPS

Start with top 1000 ports — they cover 90%+ of common services. Only go full port if you have time
Set rate limits carefully: 1000-1500 pps for naabu, 10k max for masscan to avoid network issues
Exclude web ports (80, 443) from initial scans if your target is web-heavy — focus on non-standard services
Always scan from multiple VPS in different regions to bypass IP-based rate limiting
Use -random-scan-order to avoid triggering sequential scan detection WAFs

Service Version Detection

Once you know which ports are open, determine exactly what software is running and which version. Version numbers tell you what CVEs to look for, what exploits might work, and what configurations are worth testing. Use multiple version detection techniques — passive banners and active probing complement each other.

sudo nmap -sV -sC -Pn -p 22,80,443,8080 -oA service-scan target.com

Version detection (-sV) + default scripts (-sC) against specific ports — the standard recon scan

sudo nmap -sV --version-intensity 9 -p- -oA deep-scan target.com

Max-intensity version detection on all ports — takes longer but catches every version string

nmap -sV -A -T4 -p $(tr ',' '
' < open-ports.txt | paste -sd ',') -iL targets.txt -oA batch-scan

Batch scan all open ports from discovery against a list of targets with OS detection (-A)

nmap -sV -T4 --min-rate=1000 -p 80,443,8000,8080,8443,3000,5000,9090 -iL targets.txt -oA web-scan

High-speed web port batch scan across all targets — useful when you have 100+ live hosts

nmap -sV -sC -O --osscan-guess -p 22,3306,5432,6379,27017 -oA db-servers target.com

Target database servers specifically — detect DB versions and run relevant NSE scripts

smap -iL targets.txt -oA smap-results

Smap — parses Shodan data for service information without scanning (requires Shodan API key)

nc -nv target.com 22 2>&1 | grep -E 'SSH-2\.0|OpenSSH'

Banner grab SSH service using netcat — quick version check without full nmap scan

echo '' | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -subject -dates -issuer

Grab TLS certificate details — subject, expiration, issuer for fingerprinting and compliance checks

TIPS

Use --version-intensity only when you need deep fingerprinting — it adds time but catches obscure services
Save scan results in all formats (-oA) for grepable, XML, and normal — you'll need the XML for tools
For large engagements, scan by service category (web ports, database ports, mail ports) instead of all at once
Banner grabbing with netcat/OpenSSL is silent and fast — use it for quick service verification
Cross-reference nmap version output with CVE databases using searchsploit for instant exploit mapping

NSE Script Enumeration

Nmap's NSE (Nmap Scripting Engine) scripts automate service-specific enumeration. Run them against identified services to extract banners, enumerate users, check default credentials, and detect known vulnerabilities. Group scripts by service type for organized results.

nmap -sV --script=http-enum,http-headers,http-title,http-server-header -p 80,443,8080,8443 target.com

Web service enumeration scripts — discover hidden directories, tech versions, and server info

nmap -sV --script=ssl-enum-ciphers,ssl-cert,ssl-heartbleed -p 443 target.com

SSL/TLS enumeration — check cipher strength, certificate details, and Heartbleed vulnerability

nmap -sV --script=mysql-info,mysql-empty-password,mysql-users -p 3306 target.com

MySQL enumeration — info, blank passwords, and user account discovery

nmap -sV --script=smb-enum-shares,smb-os-discovery,smb-enum-users -p 445 target.com

SMB enumeration — shared drives, OS version, and user accounts

nmap -sV --script=dns-zone-transfer,dns-brute,dns-service-discovery -p 53 target.com

DNS enumeration — check for zone transfer vulnerabilities and brute-force subdomains

nmap -sV --script=redis-info,redis-brute -p 6379 target.com

Redis enumeration — server info and brute-force common password patterns

nmap -sV --script=mongodb-info -p 27017 target.com

MongoDB enumeration — version, databases, and server status (often unprotected)

nmap -sV --script=ftp-anon,ftp-bounce,ftp-syst -p 21 target.com

FTP enumeration — check anonymous access, bounce attack, and system type disclosure

nmap -sV --script=rdp-enum-encryption,rdp-ntlm-info -p 3389 target.com

RDP enumeration — encryption level, NTLM authentication info, and Windows version

TIPS

Always run ssl-enum-ciphers on HTTPS sites — weak ciphers are an easy finding for your report
Group NSE scripts by category: safe scripts are non-intrusive, default scripts may cause minor disruption
Run http-enum on every web server — it checks for common directories, backups, and admin panels
Create a script that runs all relevant NSE scripts based on which ports are discovered (service-based automation)

Vulnerability Detection with NSE

Nmap includes NSE scripts that detect specific vulnerabilities. Run these against services where you've identified versions to validate potential CVEs. These scripts are non-intrusive but can save hours of manual vulnerability research.

nmap -sV --script=vuln -p 80,443,8080 target.com -oA vuln-scan

Run ALL vulnerability detection scripts against web ports — checks known CVEs and misconfigurations

nmap -sV --script=vulners -p 22,80,443 --script-args mincvss=5.0 -oA vulners-scan

Query the Vulners database for CVEs matching discovered service versions (CVSS > 5.0)

nmap -sV --script=http-shellshock --script-args='http-shellshock.uri=/cgi-bin/test.cgi' -p 80 target.com

Test for Shellshock vulnerability on CGI endpoints — old but still present on legacy servers

nmap -sV --script=http-slowloris-check -p 80,443,8080 target.com

Check for Slowloris DoS vulnerability — common on misconfigured Apache and IIS servers

nmap -sV --script=tls-nextprotoneg,tls-alpn -p 443 target.com

Check TLS protocol support — insecure protocols like SSLv3 and TLS 1.0 are reportable findings

TIPS

The vuln script category can be intrusive — run it carefully on production systems
Cross-reference vulners output with exploit-db/searchsploit for working exploit code
Not all CVE detections are 100% reliable — manually verify before reporting

Banner Grabbing & Manual Probing

Banner grabbing reveals exactly what software and version is running behind each port without sending crafted packets. Use netcat, OpenSSL, and curl to extract server banners. This technique is quieter than nmap and sometimes reveals version information that nmap misses.

nc -vn target.com 22 2>&1 | head -1

SSH banner grab — shows SSH version and often the OS distribution

nc -vn target.com 21 2>&1 | head -1

FTP banner grab — reveals FTP server software, version, and sometimes OS information

Extract web server headers — identifies server, framework, caching layer, and reverse proxies

curl -sI 'https://target.com' | grep -iE 'set-cookie:'

Extract cookies — identify session mechanisms and framework-specific cookie signatures

TLS certificate metadata — subject, issuer, and validity period for the service certificate

echo '' | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -text -noout | grep -A1 'Subject Alternative Name'

Extract SANs from TLS certificate — discovers additional domains covered by the same certificate

curl -s 'http://target.com' | head -50

Grab the raw HTML of the main page — look for comment tags, hidden inputs, and version disclosures

curl -s -X OPTIONS 'http://target.com' -I | grep -i 'allow:'

Check allowed HTTP methods — PUT, DELETE, and PATCH are often exposed but shouldn't be

TIPS

Banner grabbing is passive and leaves minimal logs — use it as your first touch on every service
Version numbers in banners don't always match the actual version — verify with multiple techniques
Check for server header version disclosure (Apache/2.4.49) — these map directly to known CVEs
Document every banner — they're evidence for your vulnerability report

Service Brute-Force Testing

After identifying services with authentication (SSH, FTP, SMTP, databases), test for weak credentials using targeted brute-force tools. Use small, targeted wordlists first — common usernames and passwords — before going full scale. Always respect scope and rate limits.

brutespray -f nmap-xml-output.xml -q -t 10 -T 5

Auto-brute all services found in nmap XML — matches ports to services and runs targeted wordlists

hydra -l admin -P common-passwords.txt ssh://target.com -t 4 -o hydra-ssh.txt

SSH brute-force with single username and password list — best for targeted internal testing

hydra -L common-users.txt -P common-passwords.txt ftp://target.com -t 4 -o hydra-ftp.txt

FTP brute-force with username and password lists — test for weak FTP credentials

nmap -p 1433 --script ms-sql-brute --script-args userdb=users.txt,passdb=pass.txt target.com

MSSQL brute-force via NSE script — quiet and integrated with nmap service detection

medusa -h target.com -U users.txt -P passes.txt -M ssh -t 3 -O medusa-ssh.txt

Medusa SSH brute-force — alternative to hydra with parallel connection support

TIPS

Always check scope before brute-forcing — many programs explicitly prohibit it
Use rate limiting (-t 4) to avoid account lockouts and WAF blocks
Start with default credentials lists before general wordlists
Document locked accounts — they indicate active monitoring and security controls

Service-Specific Probing

Beyond nmap, use dedicated tools for deep service probing. Each protocol has specialist tools that extract more information than a general scanner ever could. These tools reveal version-specific configurations, default credentials, and misconfigurations.

whatweb -a 3 target.com --log-verbose=web-tech.txt

Aggressive web technology fingerprinting — detects CMS, frameworks, analytics, and more

whatweb -a 3 -l live-urls.txt --log-verbose=batch-web-tech.txt

Batch technology detection across all live URLs — processes from a file list efficiently

smbclient -L //target.com -N

List SMB shares anonymously — a single misconfigured share can lead to full compromise

smbmap -H target.com -u '' -p ''

SMB map with null session — checks anonymous access and lists share permissions

dig axfr @ns1.target.com target.com

Attempt DNS zone transfer — one of the oldest but most rewarding recon checks

curl -s -I -L http://target.com | grep -i 'server\|powered-by\|x-'

Grab HTTP response headers for server info, framework hints, and security headers inventory

ike-scan target.com

IKE VPN discovery — identifies VPN servers and fingerprint the vendor (Cisco, Palo Alto, etc.)

ike-scan -M -A target.com

Aggressive IKE scan — attempts to retrieve the VPN's group ID and authentication method

rdp-sec-check.pl target.com

RDP security checker — evaluates encryption protocols and security settings

TIPS

Check for zone transfer on every nameserver — it's a quick test that can reveal the entire DNS layout
SMB shares (port 445) with anonymous access are rare but when found, they often contain sensitive data
Document every version number you find — build a CVE list for each service in your notes
IKE VPNs are common on enterprise targets — fingerprinting the vendor helps choose the right exploit tools
RDP misconfigurations (NLA disabled) are a common finding on Windows servers exposed to the internet

TOOLS IN THIS CHAPTER

naabu

Fast port scanner with CDN detection and service discovery from ProjectDiscovery

go install -v github.com/projectdiscovery/naabu/v2/cmd/naabu@latest

masscan

The fastest internet-wide port scanner — scans millions of IPs in minutes

apt install masscan

zmap

Single-port internet-wide scanner — fast and efficient for protocol-specific scans

apt install zmap

nmap

The gold standard for network exploration and security auditing

Can be downloaded from https://nmap.org/download.html

rustscan

Ultra-fast port scanner that pipes results directly into nmap for service detection

Can be downloaded from https://github.com/RustScan/RustScan/releases

smap

Shodan-based service mapper — gets service info from Shodan without touching the target

go install -v github.com/s0md3v/smap/cmd/smap@latest

brutespray

Auto-brute-force all services from nmap output with service-specific wordlists

Can be downloaded from https://github.com/x90skysn3k/brutespray

hydra

Fast network login cracker supporting 50+ protocols for targeted brute-force testing

apt install hydra

whatweb

Next-generation web technology fingerprinting tool

Can be downloaded from https://github.com/urbanadventurer/WhatWeb

ike-scan

IKE protocol scanner for discovering and fingerprinting VPN servers

apt install ike-scan

▶

You now have a complete port-level map of the target: every open port, the service running on it, its version, and relevant NSE findings. This data feeds directly into chapter 3 for endpoint-level discovery.

3CHAPTER 3

Endpoint Discovery & Technology Fingerprinting

Find every URL, parameter, and hidden function

With live subdomains and open ports in hand, the next step is mapping every accessible URL, parameter, and endpoint. The goal is to build a complete picture of the web application's surface area — every page, every API call, every parameter. This is where recon becomes actionable.

URL Collection from Historical Sources

Historical URL sources reveal endpoints that may no longer be linked from the main site but are still accessible. Wayback Machine, CommonCrawl, and URL scanning services index URLs that can expose hidden functionality, old API versions, and developer staging areas. Always run multiple URL collectors and merge the results.

Gather all known URLs from Wayback, CommonCrawl, AlienVault, and URLScan — filter for sensitive files

gau --subs example.com --o gau-all.txt

Full GAU output without filtering — capture every known URL for the target including all subdomains

katana -u https://example.com -d 2 -jc -kf -silent -o all-urls.txt

Crawl with Katana: follow links 2 levels deep, extract JavaScript, filter false positives

katana -u https://example.com -d 3 -jc -kf -aff -silent -o deep-crawl.txt

Deep Katana crawl with form extraction (-aff) and 3-level depth — catches more endpoints including forms

waybackurls example.com | sort -u > wayback-data.txt

Fetch all URLs from the Wayback Machine archive — often reveals old endpoints and backup files

waybackurls example.com | unfurl --unique keys > wayback-params.txt

Extract unique parameter names from Wayback URLs using unfurl — clean parameter dictionary

gospider -s https://example.com -d 2 -c 10 -t 10 --robots -o gospider-output

GoSpider with robots.txt parsing — discovers hidden URLs via sitemap and robot disallowed paths

gospider -S live-urls.txt -d 1 -c 5 -t 10 --other-source -o gospider-batch

Batch GoSpider across all live URLs — pipeline discovery from multiple sources including Wayback

hakrawler -url https://example.com -depth 2 -plain > hakrawler-output.txt

Lightweight Go crawler — simple but effective, especially for smaller targets

cat wayback-data.txt gau-all.txt | sort -u | grep -E '\.js|\.json|\.xml|\.yaml|\.env|\.config|\.bak|\.old|\.sql' > sensitive-files.txt

Merge all sources and filter for sensitive file extensions — configuration files, backups, and source code

TIPS

Historical URLs are the #1 source for finding API endpoints, admin panels, and forgotten functionality
Filter for .js files early — JavaScript files often contain API keys, internal endpoints, and route definitions
Merge all URL sources (gau, katana, waybackurls) into a single deduplicated list before analysis
Run GAU and WaybackURLs first (they're fast), then katana/gospider for live crawling
Check robots.txt and sitemap.xml — they often list hidden paths that the developers wanted to hide

JavaScript Analysis & Secret Discovery

Modern web applications rely heavily on JavaScript. These files often contain hardcoded API keys, internal endpoints, access tokens, and developer comments. Extract and analyze every JavaScript file from the target — automated tools can scan hundreds of files in seconds.

katana -u https://example.com -jc -d 2 -silent | grep -E '\.js(\?|$)' | sort -u > js-files.txt

Extract all JavaScript file URLs from the target's web pages using Katana

cat js-files.txt | while read url; do curl -s $url | grep -oP '(?<="|\')(https?://[^"\' ]+)' | sort -u >> js-endpoints.txt; done

Extract endpoint URLs from within JavaScript files — often where API routes are defined

nuclei -l js-files.txt -tags exposures -o js-secrets.txt

Scan JavaScript files for API keys, tokens, and hardcoded secrets using Nuclei templates

mantra -l js-files.txt -o mantra-output.txt

Automated JS secret scanner — detects API keys, access tokens, JWTs, and hardcoded credentials

cat js-files.txt | while read url; do echo $url; curl -s $url | grep -oP 'AIza[0-9A-Za-z-_]{33}|sk-[0-9a-zA-Z]{32}|ghp_[0-9a-zA-Z]{36}|AKIA[0-9A-Z]{16}' || true; done > secrets-found.txt

Regex-based secret scanning for common key patterns: Google API, OpenAI, GitHub tokens, AWS keys

subjs -i js-files.txt -o subjs-endpoints.txt

Extract endpoints from JavaScript files using subjs — lightweight and fast URL extraction

python3 -c "from urllib.parse import urlparse; import json; print('Script loaded')"

Prepare your environment for deeper JS analysis with node.js and puppeteer for dynamic extraction

TIPS

Google API keys (AIza...) in JS files are the most common finding — check if they're restricted to specific services
AWS keys (AKIA...) are critical findings — verify immediately if they're active using aws-cli
Check the source map files (.map) — they often contain the original source code with comments and secrets
Modern SPAs bundle all routes in JS — parsing JS reveals the entire front-end attack surface

URL Processing & Organization

Raw URL collections are messy. Deduplicate, sort, organize by path structure, and filter noise before analysis. Use purpose-built tools to extract the signal from the noise — categorize endpoints into API routes, static assets, admin panels, and parameters.

cat all-urls.txt | sort -u > urls-deduped.txt

Basic deduplication — removes duplicate URLs from merged source files

cat urls-deduped.txt | uro -o urls-clean.txt

URO: smart URL deduplicator — removes duplicates, parameterless variants, and path noise intelligently

cat urls-clean.txt | unfurl --unique paths > unique-paths.txt

Extract unique URL paths (without domains) to identify the directory structure

cat urls-clean.txt | unfurl --unique keys > unique-params.txt

Extract unique parameter names across all endpoints for your fuzzing dictionary

Filter for API-related paths — GraphQL, REST, Swagger docs, and versioned API routes

cat urls-clean.txt | unfurl format %d | sort -u > unique-domains.txt

Extract all unique domains (hostnames) from URL collection — useful for identifying scope expansion

Keyword filter for admin and management interfaces — high-value target list

TIPS

URO is essential — it can reduce 100k URLs to 10k meaningful ones without losing important endpoints
Group URLs by response status after probing — 200s are active, 302s are redirects, 404s are dead
API endpoints are your highest priority — focus parameter testing and authentication bypass there
Build a sitemap visualization from the path structure to understand the application architecture

Directory & File Fuzzing

Fuzzing reveals hidden directories and files that aren't linked anywhere — admin panels, backup files, configuration dumps, and staging environments. Use wordlists tailored to the target's technology stack for the best results. Fuzzing is the single most effective technique for discovering hidden attack surface.

ffuf -u https://target.com/FUZZ -w directory-list-lowercase-2.3-medium.txt -mc 200,204,301,302,307,401,403 -o fuzz-results.json

Directory fuzzing with filtered response codes — catch all interesting responses including restricted areas

ffuf -u https://target.com/FUZZ -w common-php.txt -e .php,.bak,.old,.txt,.html -mc 200 -o php-pages.json

File extension fuzzing to find backup files, old versions, and source code leaks

ffuf -u https://target.com/FUZZ -w subdomains.txt -H 'Host: FUZZ.target.com' -mc 200,301,302,403,401

Virtual host fuzzing — discover subdomains that resolve but aren't in DNS by testing Host headers

ffuf -u https://target.com/FUZZ -w common-admin.txt -mc 200,403 -o admin-panels.json

Target admin panels specifically — 403 responses often mean the page exists but is restricted

ffuf -u https://target.com/FUZZ -w content-discovery-wordlist.txt -recursion -recursion-depth 2 -mc 200,204,301,302 -o recursive-fuzz.json

Recursive directory fuzzing — automatically follows discovered directories and fuzzes inside them

ffuf -u https://target.com/graphql -w param-list.txt -X POST -d 'query={FUZZ}' -H 'Content-Type: application/json' -mc 200

GraphQL endpoint fuzzing — discover available queries by injecting field names into introspection queries

ffuf -u https://target.com/FUZZ -w files-with-sensitive-data.txt -e .sql,.dump,.tar.gz,.zip,.tgz -mc 200 -o sensitive-leaks.json

Search for sensitive data leaks — database dumps, backups, and compressed archives

dirsearch -u https://target.com -e php,asp,js,txt -x 404,503 -t 50 --recursive --deep-recursive

Dirsearch as alternative to ffuf — multi-extension and recursive scanning with thread control

dirsearch -l live-urls.txt -e php,html,txt -x 404 -t 30 --format json -o dirsearch-batch.json

Batch dirsearch across all live URLs — useful for large engagements with hundreds of hosts

TIPS

Start with a small, targeted wordlist before going large — you can always expand
401 and 403 responses are valuable — they confirm the file exists even if you can't access it
Use the -recursion flag in ffuf to automatically fuzz discovered directories
Always fuzz with multi-extension (-e) — a backup.php~ or config.bak can contain the entire database config
Filter out 404 and 503 responses early — they add noise without actionable results

Content Discovery with Advanced Filters

Advanced content discovery uses length filtering, response comparison, and custom matchers to identify real endpoints among thousands of false positives. Smart filtering reduces noise from 99% to actionable results within minutes.

ffuf -u https://target.com/FUZZ -w big-wordlist.txt -mc 200 -fs 1234 -o filtered-results.json

Filter by response size (-fs) to ignore known default pages — 1234 is the size of your custom 404 page

ffuf -u https://target.com/FUZZ -w wordlist.txt -mc all -fc 404 -ac

Auto-calibrate filtering (-ac) — ffuf detects the 404 response pattern and filters it automatically

ffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200 -recursion -recursion-depth 2 -replay-proxy http://127.0.0.1:8080

Recursive fuzzing with Burp Suite replay — automatically send discovered pages to Burp for manual inspection

feroxbuster -u https://target.com -w wordlist.txt -d 2 -t 50 -o ferox-results.json

Rust-based content discovery with recursion and smart 404 filtering — fast alternative to ffuf

feroxbuster -u https://target.com -w wordlist.txt -x php,txt,html,json -d 3 -s 200,204,301,302,403,401,500 -o deep-ferox.json

Feroxbuster with multi-extension, deep recursion, and status code whitelist — thorough but fast

TIPS

Use -ac (auto-calibrate) on every ffuf scan to save hours of manual filtering
Response size filtering (-fs) is more reliable than status code filtering — many 404s return 200 status
Run feroxbuster with -d 3 for complete coverage, but use -d 1 for initial quick scan
Replay interesting findings through Burp Suite for immediate manual inspection

API Endpoint Discovery

APIs are the backbone of modern web applications and a rich source of vulnerabilities. Find API documentation (Swagger, OpenAPI), test GraphQL introspection, enumerate RESTful endpoints, and look for API keys in client-side code. APIs often expose functionality not available through the web interface.

ffuf -u https://target.com/api/v1/FUZZ -w api-endpoints.txt -mc 200,201,401,403,405 -o api-endpoints.json

Discover API endpoints by fuzzing common API paths with different response code filtering

curl -s 'https://target.com/swagger/v1/swagger.json' | jq '.paths | keys'

Fetch Swagger/OpenAPI documentation — complete API schema with endpoints, methods, and parameters

curl -s 'https://target.com/graphql' -X POST -H 'Content-Type: application/json' -d '{"query":"query { __schema { types { name } } }"}' | jq '.'

GraphQL introspection query — if enabled, reveals the entire schema including hidden queries and mutations

curl -s 'https://target.com/graphql' -X POST -H 'Content-Type: application/json' -d '{"query":"{ __schema { queryType { fields { name args { name } } } } }"}' | jq '.'

Detailed GraphQL introspection — enumerates all query fields and their arguments

Extract API routes from URL collection — filter for known API path patterns

nuclei -l api-routes.txt -tags api,exposure -o api-vulns.txt

Scan discovered API endpoints for common API vulnerabilities using Nuclei templates

curl -s 'https://target.com/.well-known/openid-configuration' | jq '.'

Check OpenID Connect discovery endpoint — reveals authentication endpoints, issuer, and JWKS URI

TIPS

Swagger/OpenAPI docs are the holy grail — they list every endpoint with parameters and authentication requirements
If GraphQL introspection is enabled, the entire database schema may be exposed — document it thoroughly
API endpoints often lack the authentication controls that protect the main web application
Check for common API docs paths: /api/docs, /swagger, /openapi.json, /api/v1/openapi.json

Technology Fingerprinting

Every technology choice introduces specific attack surfaces. Identify the CMS, framework, CDN, WAF, and server software of every target. This knowledge guides your exploit selection and helps you avoid wasting time on irrelevant attacks. Cross-reference technology data with known CVEs for instant exploit mapping.

httpx -l live-urls.txt -silent -tech-detect -title -web-server -status-code -o fingerprinted.txt

Batch technology detection across all live URLs — framework, CDN, WAF, server header in one pass

wappalyzer-cli https://target.com

Wappalyzer CLI for technology stack detection — supports single URL deep analysis

whatweb -a 3 https://target.com --log-verbose=whatweb-detailed.txt

WhatWeb aggressive detection — more thorough than httpx but slower, catches obscure CMS versions

curl -sIX GET https://target.com | grep -i 'server\|powered-by\|x-generator\|x-frame-options'

Manual header inspection to identify server software and security header gaps

nuclei -l live-urls.txt -tags tech-detect -o tech-stack.json -json

Use Nuclei templates to detect technologies — runs 100+ tech fingerprint templates in parallel

nuclei -l live-urls.txt -tags cves -severity critical,high -o cve-scan.txt

Quick critical/high CVE scan against all live URLs — catch low-hanging fruit before manual testing

curl -s 'https://target.com' | grep -iE 'wordpress|wp-content|wp-includes|wp-json' > cms-detection.txt

CMS detection from page source — WordPress, Joomla, Drupal, and other CMS have unique fingerprints in HTML

curl -s 'https://target.com/robots.txt'

Check robots.txt — often lists admin paths, staging areas, and directories the devs wanted to hide from search engines

curl -s 'https://target.com/sitemap.xml' | grep -oP '<loc>[^<]+</loc>' | sed 's/<[^>]+>//g' > sitemap-urls.txt

Parse sitemap.xml for all indexed URLs — frequently includes hidden pages and admin sections

TIPS

Cross-reference technology data with known CVEs — a specific version of Apache/Nginx/WordPress = specific exploits
Identify the WAF early (Cloudflare, Akamai, ModSecurity) to plan your bypass strategy later
Document the full tech stack per subdomain — you'll reference this during the exploitation phase
Robots.txt is NOT a security measure but it often reveals the developer's hidden paths and testing endpoints
Run nuclei CVE templates after fingerprinting — matching tech versions to CVEs is automated

Parameter Discovery & Analysis

Parameters are where vulnerabilities live. Find every parameter across every endpoint, then test them systematically. Use scraping, crawling, and common parameter wordlists to build your attack surface. The more parameters you test, the more bugs you'll find.

katana -u https://target.com -d 3 -aff -kf -silent | grep -oP '\?.*?=[^&]+' | sort -u > params.txt

Extract all URL parameters from crawled pages using regex pattern matching

gau --subs target.com | qsfind | sort -u > discovered-params.txt

Find parameters in Wayback data that aren't commonly scanned — hidden params from older endpoints

ffuf -u https://target.com/page?FUZZ=test -w param-list.txt -fc 500,502

Parameter fuzzing — test common parameter names across a known endpoint to discover hidden inputs

Filter out tracking/analytics parameters — focus on functional parameters that affect application logic

python3 -c "import sys; params = set(); [params.update(line.split('?')[1].split('&') for line in sys.stdin if '?' in line) for _ in [0]]; print('\n'.join(p.split('=')[0] for p in set(sum(params, []))))" < all-urls.txt | sort -u > all-params.txt

Python one-liner to extract ALL unique parameter names from URL collection — thorough but slow for large files

cat all-urls.txt | unfurl --unique keys > all-unfurl-params.txt

Unfurl parameter extraction — clean, fast, and handles complex URLs with multiple parameters

Regex-based parameter name extraction from full URL list — works on any dataset

TIPS

Focus on parameters that affect application logic (id, user, file, page, action, token, redirect, url)
Parameters found in historical URLs are gold — they often lead to deprecated but still-functional logic
Build your own parameter wordlist over time by collecting interesting params from every engagement
Test parameter pollution on every endpoint with multiple parameters of the same name
Document which endpoints accept POST vs GET parameters — API-style endpoints often accept JSON body params

Screenshotting & Visual Analysis

Screenshots give you a bird's eye view of the target's web properties. Skimming screenshots is much faster than visiting each URL manually. Use this to identify interesting pages, login portals, admin panels, and unusual content in seconds rather than hours.

gowitness file -f live-urls.txt --destination screenshots

Batch screenshot all live URLs and generate an HTML report for visual browsing

gowitness file -f live-urls.txt --destination screenshots --resolution 1920x1080 --delay 2

Screenshots with custom resolution and page load delay for JavaScript-rendered content

gowitness nmap -f nmap-output.xml --destination nmap-screenshots

Screenshot directly from nmap XML — combines port scan with visual recon in one command

Search the screenshot report for interesting page titles to identify high-value targets

cat screenshots/gowitness-report.html | grep -oP '(?<=alt=")[^"]+' | sort -u > screenshot-titles.txt

Extract all page titles from the screenshot report for keyword analysis and categorization

aquatone-scan -u https://target.com && aquatone-gather ./aquatone

Aquatone alternative — screenshots with built-in clustering by similarity (dev vs prod environments)

TIPS

Open the gowitness HTML report in your browser — it groups screenshots visually for rapid triage
Login portals, admin panels, and dashboards are your highest-priority targets in any engagement
Check for default credentials on any discovered login pages — document them for your report
Screenshots of error pages (500, 503) often reveal stack traces, debug info, and version numbers

TOOLS IN THIS CHAPTER

gau

GetAllUrls — fetches known URLs from Wayback, CommonCrawl, AlienVault, and URLScan

go install -v github.com/lc/gau/v2/cmd/gau@latest

katana

Fast web crawler from ProjectDiscovery with JS parsing and form extraction

go install -v github.com/projectdiscovery/katana/cmd/katana@latest

waybackurls

Fetch all URLs from Wayback Machine archive for a given domain

go install -v github.com/tomnomnom/waybackurls@latest

gospider

Fast web spider with robots.txt parsing, sitemap support, and form extraction

go install -v github.com/jaeles-project/gospider@latest

hakrawler

Lightweight Go web crawler for endpoint discovery and URL collection

go install -v github.com/hakluke/hakrawler@latest

ffuf

The fastest web fuzzer — directory busting, parameter fuzzing, and VHOST discovery

go install -v github.com/ffuf/ffuf/v2@latest

feroxbuster

Rust-based content discovery tool with recursion, multi-extension, and smart filtering

Can be downloaded from https://github.com/epi052/feroxbuster/releases

dirsearch

Python-based directory brute-forcer with multi-threading and recursive scanning

Can be downloaded from https://github.com/maurosoria/dirsearch

uro

Smart URL deduplicator — removes noise and parameterless variants from URL lists

pip install uro

unfurl

URL extractor and parser — extract domains, paths, parameters, and values from URL lists

go install -v github.com/tomnomnom/unfurl@latest

nuclei

Fast vulnerability scanner with 10,000+ templates including tech detection and CVE scanning

go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest

gowitness

Web screenshot utility with reporting — batch screenshots for visual recon

go install -v github.com/sensepost/gowitness@latest

mantra

Automated JS secret scanner — detects API keys, tokens, JWTs, and credentials in JS files

go install -v github.com/MrEmpy/mantra@latest

subjs

Fast JavaScript file endpoint extractor — pulls URLs from JS files for further analysis

go install -v github.com/lc/subjs@latest

▶

You now have a complete endpoint-level map: every URL, the technology behind it, its parameters, and visual evidence. This is the final output of the recon flow — the foundation for every vulnerability you'll find.

Recon Flow

Subdomain enumeration, port scanning, technology fingerprinting, and endpoint discovery — the foundation of every bounty

1CHAPTER 1

Subdomain Enumeration & Asset Discovery

Map the target's entire digital footprint before you attack

Passive Reconnaissance

subfinder -d example.com -o passive-subs.txt

Passive subdomain enumeration using 30+ sources (CT logs, DNS dumps, search engines, APIs)

subfinder -d example.com -all -o all-passive.txt

Enable all passive sources including slower APIs (Shodan, Virustotal, SecurityTrails)

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u

Query Certificate Transparency logs directly for all issued certificates on the domain

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > crtsh-subs.txt

Same as above but filter out wildcard entries for a cleaner subdomain list

findomain --target example.com --output

Fast passive subdomain discovery using Certificate Transparency, AnubisDB, and other sources

assetfinder --subs-only example.com > assetfinder-subs.txt

Simple passive subdomain discovery using various sources including crt.sh and DNS

cat passive-subs.txt | dnsx -silent -o live-subs.txt

Validate discovered subdomains — only keep those that resolve to an IP address

cat *.txt | sort -u | grep -E '^[a-zA-Z0-9.-]+\.example\.com$' > all-passive-unique.txt

Merge all passive sources into one deduplicated and filtered list

chaos -d example.com -key $CHAOS_KEY -o chaos-subs.txt

Fetch subdomains from ProjectDiscovery's Chaos dataset — curated passive dataset updated daily

curl -s 'https://api.securitytrails.com/v1/domain/example.com/subdomains' -H 'APIKEY: YOUR_KEY' | jq -r '.subdomains[]' | awk '{print $0".example.com"}' > securitytrails-subs.txt

SecurityTrails API — excellent passive source with historical subdomain data

TIPS

Set up API keys for subfinder: export the keys in your shell config for better coverage (Shodan, Virustotal, SecurityTrails, Censys)
Certificate Transparency is the single most reliable passive source — always run crt.sh independently
Run passive enumeration in the background while you work on other parts of the engagement
Merge ALL passive outputs before moving to active — you'll get 30-40% more subs by combining tools
Create a shell script that runs all passive tools sequentially and merges the output automatically

Certificate Transparency & SSL Analysis

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u > crtsh-all.txt

Full CT log dump from crt.sh — the most comprehensive free CT source

curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sed 's/\*\.//g' | anew subs-found.txt

Strip wildcard prefixes and append only new subdomains to your master list

tlsx -san -cn -host example.com -o tlsx-output.txt

Fast TLS certificate enumeration — extract SANs (Subject Alternative Names) and CNs from certificates

echo example.com | tlsx -san -cn -so -o cert-domains.txt

TLS certificate subject output — captures every domain name listed in the certificate

openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -text | grep -A1 'Subject Alternative Name' | tr ',' '\n' | sed 's/^ *//' | awk '{print $1}' | sed 's/DNS://g' | sort -u

Manual SSL inspection — extract SANs using raw OpenSSL when tools aren't available

curl -s 'https://certspotter.com/api/v0/certs?domain=example.com' | jq -r '.[].dns_names[]' | grep 'example.com' | sort -u > certspotter-subs.txt

CertSpotter API — another CT source that sometimes finds domains crt.sh misses

curl -s 'https://api.certspotter.com/v1/issuances?domain=example.com&include_subdomains=true&expand=dns_names' | jq -r '.[].dns_names[]' | grep 'example.com' | sort -u

CertSpotter with include_subdomains — catches wildcard certificate SANs

python3 -c "import ssl, socket; cert = ssl.get_server_certificate((('example.com', 443))); print(cert)" | openssl x509 -text -noout | grep 'Subject:'

Python SSL extraction — useful in scripts for automated certificate collection

TIPS

Search for SANs (Subject Alternative Names) — they often contain internal services, subdomains, and dev portals
Check for expired certificates — they sometimes list domains that are no longer monitored but still accessible
Use tlsx for bulk scanning — it's much faster than OpenSSL when processing hundreds of domains
CertSpotter often catches certificates that crt.sh misses because it queries a different set of CT logs