# Extensive Recon Guide For Bug Hunting

### WHAT IS RECONNAISSANCE? Reconnaissance is one of the most important aspects of penetration testing. It’s also known as Recon.\ Recon will help you to increase attack surface area and may allow you to get more vulnerabilities but the ultimate goal is to dig deep in the target.

Recon = Increase in Attack surface = More vulnerabilities\

Recon = Finding untouched endpoints = Fewer duplicates\

Recon = Sharpening your axe before attack *** ### 1. SUBDOMAIN ENUMERATION Subdomain enumeration is the process of finding subdomains for one or more domains. **Tools used ⇒**

Visual Recon⇒ * [https://Virustotal.com](https://virustotal.com/) * [https://Subdomainfinder.c99.nl](https://subdomainfinder.c99.nl/) * * *

Command Line⇒ * [Amass](https://github.com/owasp-amass/amass) * [Sunfinder](https://github.com/projectdiscovery/subfinder) * [dnsx](https://github.com/projectdiscovery/dnsx) * [Chaos](https://chaos.projectdiscovery.io/#/) * [Assetfinder](https://github.com/tomnomnom/assetfinder) **Oneliners for Subdomain Enumeration ⇒** ```shell $ amass enum -passive -norecursive -noalts -df domians.txt -o subs-list.txt $ dnsx -silent -d $domain -w ~/wordlist.txt -o ~/dnsbrute.txt $ cat domain.txt | dnsgen - | massdns -r ~/resolvers.txt -o S -w alive.txt ``` *** ### 2. FILTERING THE SUBDOMAINS WITH HTTPX ```shell $ httpx -l domain.txt -timeout 13 -o domain-probe.txt ``` **PORT SCANNING ⇒** ```shell $ naabu -list sub-list.txt -top-ports 1000 -exclude-ports 80,443,21,22,25 -o ports.txt $ naabu -list sub-list.txt -p - -exclude-ports 80,443,21,22,25 -o ports.txt $ cat domain-subs.txt | aquatone -ports xlarge -scan-timeout 300 -out aquatone.txt ``` **SUBDOMAIN OF SUBDOMAIN ENUMERATION ⇒**\ “This is one of the rare things people search for.”\ **Tools used:** * **Subbrute**: * **Altdns**: * Usage: `./altdns.py -i subdomains.txt -o data_output -w words.txt -r -s output.txt` *** ### 3. SCREENSHOT TOOLS These tools are capable of taking screenshots of websites to view offline anytime. **Tools used ⇒** * **Eyewitness**: * **httpscreenshot**: *** ### 4. BROADENING YOUR SCOPE More targets lead to more option which ultimately lead to more opportunities. * Crunchbase * bgp.he.net * tools.whoisxmlapi.com * *** ### 5. WHAT TO DO AFTER ENUMERATION? | Collecting URLs * **Waybackurls**: * **Gau**: * **web archieve**: urlkey *** ### 6. TIPS AND TRICKS 1\. After collecting URLs, curl out the responses of the URLs and grep for the following URLs: * drive.google * docs.google * /spreadsheets/d/ * /document/d/ ```shell $ cat domains.txt | katana -silent | while read url; do cu=$(curl -s $url | grep -E '(drive. google | docs. google | spreadsheet\/d | document.\/d\/)' ;echo -e " ==> $url" "\n"" $cu" ; done ``` 2\. Using paramspider, gxss to detect Cross-site Scripting (XSS) * Commands:- ```shell $ cat params | qsreplace yogi | dalfox pipe --mining-dom --deep-domxss --mining-dict --remotepayloads=portswigger,payloadbox --remote wordlists=burp,assetnote -o xssoutput.txt ``` ```shell $ cat alive.txt | waybackurls | gf xss | uro | httpx -silent | qsreplace '">

Grep all urls from wayback or gau. * Collect all js file “.js” * Filter js file: ```go $ httpx -content-type | grep 'application/javascript' ``` * Perform Nuclei scan ```shell $ nuclei -t /root/nuclei-templates/exposures/ ```

Js Recon Tip: * Collect all endpoints from Js files & Create a wordlist from those. * Craft a POST request with any parameter. * Use that request to fuzz for sensitive directory. * **Tools**:- [JSFScan.sh](https://github.com/KathanP19/JSFScan.sh) , Jsminer {Burp Extension} , [Trufflehog](https://github.com/trufflesecurity/trufflehog) *** ### 13. SOME AUTOMATION FRAMEWORKS

**Sudomy**: \

**Reconftw**: *** ### Final Thoughts

**Verify Data** * Some data are intended, No bug here.

**Reported > Invalid** * Don’t get angry, You may lose bonds with good program

**Yes, They do accept Third Party** * Your crafting and exploits are gold. Make it high as you can

**Be humble with Program** * Money going no where. Don’t message constant to team --- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://methodological-notes.gitbook.io/methodology/recon-strategies-by-other-hackers/extensive-recon-guide-for-bug-hunting.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.