web2-reconlisted

# WEB2 RECON PIPELINE Full asset discovery from nothing to a prioritized URL list ready for hunting. --- ## SETUP (one-time) ```bash # 1. Set your Chaos API key (get free key at chaos.projectdiscovery.io) export CHAOS_API_KEY="your-key-here" # Add to ~/.zshrc or ~/.bashrc for persistence: echo 'export CHAOS_API_KEY="your-key-here"' >> ~/.zshrc # 2. Update nuclei templates (run weekly) nuclei -update-templates # 3. Configure subfinder with API keys for more sources mkdir -p ~/.config/subfinder cat > ~/.config/subfinder/config.yaml << 'EOF' # Get free keys at: virustotal.com, securitytrails.com, censys.io, shodan.io virustotal: [YOUR_VT_KEY] securitytrails: [YOUR_ST_KEY] censys_apiid: YOUR_CENSYS_ID censys_secret: YOUR_CENSYS_SECRET shodan: [YOUR_SHODAN_KEY] EOF # 4. Verify all tools installed which subfinder httpx dnsx nuclei katana waybackurls gau dalfox ffuf anew gf interactsh-client ``` --- ## THE 5-MINUTE RULE > If a target shows nothing interesting after 5 minutes of recon, move on. Don't burn hours on dead surface. **5-minute kill signals:** - All subdomains return 403 or static marketing pages - No API endpoints visible in URLs - No JavaScript bundles with interesting endpoint paths - nuclei returns 0 medium/high findings - No forms, no authentication, no user data --- ## STANDARD RECON PIPELINE ### Pre-Hunt: Always Run First ```bash TARGET="target.com" # Step 0: Passive — crt.sh certificate transparency (no API key needed) curl -s "https://crt.sh/?q=%.$