Advanced Reconnaissance Methodology

Reconnaissance (Recon) is the most critical phase of bug bounty hunting. A vulnerability cannot be exploited if the asset hosting it is never found. In an era where thousands of hunters scan the main domains, success lies in finding the forgotten, hidden, and obscure assets.

Why Reconnaissance Is No Longer “Basic”

Basic recon involves running a subdomain scanner and checking the results. Advanced recon involves understanding the organization’s digital footprint, infrastructure, and development habits. The goal is to increase your attack surface beyond what the average hunter sees.

Step 1: Deep Business Understanding

Before technical scanning, understand the target organization:

• Acquisitions & Mergers: Did they recently buy a smaller company? Their infrastructure might be less secure and integrated.
• ASN (Autonomous System Number): Find all IP ranges owned by the company using tools like Amass or bgp.he.net.
• Vertical Scope: Are there sister companies or international domains (e.g., target.de, target.co.jp) in scope?

CBBEWant to practise this hands-on? Certified Bug Bounty Expert covers it with live labs and mentor support.

Step 2: Advanced Asset Discovery

Go wide before going deep:

• Subdomain Enumeration: Use tools like Subfinder, Amass, and Assetfinder combined.
• Permutation Scanning: Tools like Altdns generate permutations (e.g., dev-api, stg-admin) to find unlinked subdomains.
• Certificate Transparency Logs: Monitor crt.sh for new certificates issued to the organization.

Step 3: DNS Mapping & Subdomain Takeover

Analyze the DNS records for every discovered subdomain:

• CNAME Records: Look for CNAMEs pointing to third-party services (GitHub, Heroku, AWS S3) that no longer exist. This is a potential subdomain takeover.
• A/AAAA Records: Map subdomains to IP addresses to find shared hosting or cloud infrastructure.

Step 4: Technology Fingerprinting

Identify what is running on the assets. “Wappalyzer on Steroids”:

• Tech Stack: Is it WordPress? Django? React?
• Server Headers: Nginx version? Apache?
• WAF Detection: Is it behind Cloudflare or Akamai?
• Tools like httpx and Nuclei are invaluable here.

Step 5: JavaScript Recon

Modern apps are heavy on client-side code. Dig into the JS files:

• Link Discovery: Extract all URLs and endpoints mentioned in .js files.
• Secret Finding: Look for API keys, AWS tokens, or internal credentials accidentally hardcoded.
• Source Maps: If enabled, they allow you to reconstruct the original source code.

Step 6: API and GraphQL Recon

APIs are often the soft underbelly of applications:

• Discovery: Fuzz for common paths like /api/v1, /v2, /swagger.json, /graphql.
• Documentation: Look for exposed Swagger UI or GraphiQL interfaces.
• Introspection: If GraphQL is present, try an introspection query to dump the entire schema.

Step 7: Authentication & Role Mapping

Create accounts if possible. Understand the user hierarchy:

• Role Analysis: Admin vs. User vs. Viewer.
• Registration Flows: How are accounts created? Are there invite-only flows you can bypass?
• Password Reset: Analyze the token generation and validation logic.

Step 8: Business Logic & Workflow Analysis

Map out critical business functions:

• Payment Gateways: How are transactions processed?
• Order Fulfillment: Can you manipulate cart items or shipping costs?
• Privilege Boundaries: What stops User A from seeing User B’s data?

Step 9: Cloud Exposure Checks

Cloud misconfigurations are rampant:

• Storage Buckets: Fuzz for AWS S3 buckets, Azure Blobs, and Google Cloud Storage buckets related to the company name.
• Cloud Functions: Look for exposed serverless functions.

Step 10: Prioritization

You have a massive list of assets. Now, prioritize:

• Freshness: New assets are more likely to have bugs.
• Complexity: Complex login portals are better targets than static marketing pages.
• Technology: Older, unpatched tech stacks are low-hanging fruit.

Step 11: Documentation & Mind Mapping

Keep organized notes. Use tools like Obsidian, Notion, or XMind. Draw a map of the infrastructure. Visualizing the network often reveals connections you missed in a text list.