recon-and-methodologylisted

# SKILL: Recon and Methodology — Expert Bug Bounty Playbook > **AI LOAD INSTRUCTION**: Systematic recon and bug-finding methodology from top bug hunters. Covers subdomain enumeration, endpoint discovery, tech fingerprinting, and the hunter's mental model for finding bugs that others miss. Key insight: most high-severity bugs are found through systematic coverage, not just clever payloads. --- ## 1. RECON HIERARCHY ``` Target Selection └── Scope Definition (in-scope assets) └── Asset Discovery (subdomains, IPs, domains) └── Tech Fingerprinting (what's running) └── Endpoint Discovery (attack surface) └── Vulnerability Testing (per vulnerability type) ``` --- ## 2. SUBDOMAIN ENUMERATION (CRITICAL FIRST STEP) ### Passive (no DNS queries to target) ```bash # Subfinder (aggregates multiple sources): subfinder -d target.com -o subdomains.txt # Amass passive: amass enum -passive -d target.com # Certsh (certificate transparency): curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u # SecurityTrails API, Shodan: # Web: https://securitytrails.com/list/apex_domain/target.com ``` ### Active (DNS brute force + resolution) ```bash # Massdns + wordlist: massdns -r /path/to/resolvers.txt -t A -o S -w output.txt \ <(cat wordlist.txt | sed 's/$/.target.com/') # ffuf for subdomain brute: ffuf -w subdomains-wordlist.txt -u https://FUZZ.target.com \ -mc 200,301,302,403 -H "Host: FUZZ.target.com" # DNSx for