Recon Guide · By Masaud Ahmed

Complete Bug Bounty Recon Workflow for Hunters

Bug Bounty / 12 min read

This guide provides a comprehensive reconnaissance workflow for bug bounty hunters and penetration testers. Follow these steps to systematically discover vulnerabilities in web applications.

At masaudsec.com, we specialize in cybersecurity, ethical hacking, and penetration testing services. Contact us for professional security assessments.

Recon Workflow Steps

The complete workflow runs through ten steps. Each one builds on the last — run them in order on your target domain to get a clean, testable attack surface.

01. Subdomain Enumeration

Use multiple tools to passively collect subdomains. More tools = better coverage.

subfinder -d crunch.co.uk -o subfinder.txt

assetfinder --subs-only crunch.co.uk | tee assetfinder.txt

findomain -t crunch.co.uk -q | tee find-domain.txt

02. Merge and De-duplicate

Combine all subdomains and remove duplicates to form a master list.

cat *.txt > all.txt && sort -u all.txt -o all.txt

03. Check for Live Subdomains

Use Httpx to see which subdomains are active and responding.

cat all.txt | httpx -l all.txt -o live_domains.txt

04. Collect URLs and Endpoints

Use Waymore and Katana to discover hidden or archived endpoints.

waymore -i "crunch.co.uk" -mode U -oU waymore.txt

pip install qurl

cat live_domains.txt | katana -f qurl -silent -kf all -jc -aff -d 5 -o katana-param.txt

05. Find Sensitive or Hidden Files

Look for interesting file types which may expose data.

grep -E -i -o '\S+\.(cobak|backup|swp|old|db|sql|asp|aspx|aspx~|asp~|py|py~|rb|rb~|php|php~|bak|bkp|cache|cgi|conf|csv|html|inc|jar|js|json|jsp|jsp~|lock|log|r(ar|)\.old|sql|sql\.gz|sql\.zip|sql\.tar\.gz|sql~|swp|swp~|tar|tar\.bz2|tar\.gz|txt|wadl|zip|log|xml|json|\.secret$|\.yml$|\.env$|\.config$|\.conf$|\.ini$|\.htaccess$|\.htpasswd$|\.pem$|\.key$|\.crt$|\.cer$|\.pfx$|\.p12$|\.tmp$|\.temp$|\.dump$|\.passwd$|\.shadow$|\.git$|\.svn$|\.DS_Store$|\.idea$|\.vscode$|\.bash_history$|\.zsh_history$|\.ssh$|\.id_rsa$|\.id_dsa$|\.ppk$|\.aws$|\.boto$|\.credentials$|\.token$|\.session$|\.pyc$|\.jar$|\.war$|\.class$|\.apk$|\.ipa$|\.dex$|\.plist$|\.cfg$|\.cnf$|\.properties$|\.sql.gz$|\.tar.gz$|\.backup.sql$|\.backup.gz$|\.access.log$|\.error.log)\b' "waymore.txt" "katana-param.txt" | sort -u > finding.txt

06. Clean URLs (Remove Static Files)

Filter out unimportant file types (images, fonts, etc.).

cat waymore.txt katana-param.txt | sort -u | egrep -v '\.(css|png|blog|utm_source|utm_content|utm_campaign|utm_medium|jpeg|jpg|svg|gifs|tif|tiff|png|ttf|woff|woff2|ico|pdf|svg|txt|gif|wolf)$' > waymore-katana-unfilter-urls.txt

07. Filter Live URLs

Filter out dead URLs using Httpx again.

cat waymore-katana-unfilter-urls.txt | httpx -t 150 -rl 150 -o waymore-katana-filter-urls.txt

08. Extract Parameterized URLs

Grab URLs with parameters (=) – useful for injection testing.

grep -a = "waymore-katana-filter-urls.txt" >> parameters_with_equal.txt

09. Scan with Nuclei

Use Nuclei to run automated vulnerability scans.

nuclei -l live_domains.txt -o nuclei-result.txt

nuclei -u example.com -o result.txt

10. Send to Burp for Manual Testing

Send all live URLs to Burp Suite using curl and Parallel.

cat waymore-katana-unfilter-urls.txt | parallel -j 10 'curl --proxy http://127.0.0.1:8080 -sk {}' >> /dev/null

cat waymore-katana-filter-urls.txt | parallel -j 10 'curl --proxy http://127.0.0.1:8080 -sk {}' >> /dev/null

Download All Commands

Get all these commands in a single script file for easy execution.

Download Complete Recon Script

Why Automation in Bug Bounty?

Automation is crucial in bug bounty hunting for several reasons:

• 1Efficiency: Automating repetitive tasks saves time and allows you to focus on analysis.
• 2Scale: You can scan hundreds or thousands of targets with the same effort as scanning one.
• 3Speed: Automation helps you find vulnerabilities before other hunters.
• 4Documentation: Scripts serve as documentation of your methodology.

Frequently Asked Questions