The Advanced Bug Bounty Recon Playbook

Subfinder and httpx get you in the door. Everything past that door, ASN pivoting, JS secret mining, GraphQL schemas, cross-role IDOR mapping, is what turns duplicates into accepted reports. This playbook covers the full workflow in the order it actually gets used: expand the surface, mine the content, validate the finding, then report it.

Most hunters run the same three tools every program sees within minutes of launch, and then wonder why every report comes back as a duplicate. The bugs that pay are sitting one or two pivots further out. This is that next layer, stage by stage, with the exact commands.

Stage 1: Asset Discovery

The baseline. Do it properly so every later stage has a complete map to work from.

Passive subdomain enumeration

Pull subdomains from multiple public sources before touching the target directly.

subfinder -d target.com -all -o subs_subfinder.txt
amass enum -passive -d target.com -o subs_amass.txt
assetfinder --subs-only target.com >> subs_amass.txt

Certificate transparency sweep

crt.sh regularly surfaces staging and internal-sounding subdomains that never appear in passive-source aggregators.

curl -s "https://crt.sh/?q=%25.target.com&output=json" \
  | jq -r '.[].name_value' | sort -u > subs_crtsh.txt

Merge, resolve, and probe for live hosts

httpx tells you what's actually alive, on what port, and running what technology, before you spend time on anything dead.

cat subs_*.txt | sort -u > all_subs.txt
httpx -l all_subs.txt -sc -title -td -o live_hosts.txt

Stage 2: Surface Expansion

This is the stage almost nobody runs, and it's where unlinked, forgotten infrastructure shows up.

ASN and IP range pivoting

Look up the org's ASN on bgp.he.net, then sweep the entire announced range instead of just its known hostnames.

# find every range announced under the target's ASN
whois -h whois.radb.net -- '-i origin AS<ASN>' | grep route
naabu -list ip_ranges.txt -top-ports 1000 -o asn_live.txt

Favicon hash pivoting

A unique favicon hash on Shodan can surface infrastructure running the same stack that was never linked from the main domain.

python3 favfreak.py -f https://target.com/favicon.ico
# then search the resulting hash
shodan search 'http.favicon.hash:145425142'

Cloud bucket discovery

Generate permutations from the company and product names, then brute-force common storage endpoints.

cloud_enum -k target -k targetapp -k target-media

Reverse WHOIS and CT correlation

Cross-reference the registrant org or email against crt.sh to catch shadow domains registered under the same identity.

curl -s "https://crt.sh/?q=%25&output=json" \
  | jq -r '.[] | select(.name_value | contains("target"))'

Stage 3: Content Discovery

Once assets are mapped, pull every URL and endpoint that's ever been publicly referenced.

Historical URL mining

Old, unlinked, and forgotten endpoints regularly outlive the pages that once linked to them.

cat live_hosts.txt | waybackurls > urls_wayback.txt
cat live_hosts.txt | gau --threads 5 > urls_gau.txt

Crawling JS-heavy applications

katana follows client-side routing that a normal crawler misses entirely.

katana -u https://target.com -jc -d 3 -o urls_katana.txt

Directory and file brute-forcing

Target this at each live host, not just the root domain. Admin panels often live on subdomains.

ffuf -u https://FUZZ.target.com -w subs_wordlist.txt -mc 200,301,403

Stage 4: API and JS Mining

Where the real bugs hide once the obvious surface has been mapped.

JS bundle secret mining

Built JS frequently ships internal routes, staging URLs, and forgotten keys.

cat urls_katana.txt | grep '\.js$' | httpx -silent > js_files.txt
trufflehog filesystem js_files.txt --only-verified

GraphQL introspection

If introspection is left on, you get the entire schema, including mutations that were never meant to be public.

curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name,fields{name}}}}"}'

Hidden parameter mining

Undocumented parameters regularly flip validation, authorization, or debug behaviour on and off.

arjun -u https://target.com/api/endpoint -m GET,POST

Swagger and OpenAPI leaks

A single leaked spec file can reveal the entire internal API surface at once.

for p in swagger.json openapi.json api-docs v1/api-docs; do
  httpx -u https://target.com/$p -silent -mc 200
done

Stage 5: Validation and Prioritization

Finding something is half the job. This stage turns a raw finding into a report a triager accepts on the first read.

CORS misconfiguration testing

Reflect an arbitrary origin with credentials included and check whether the server trusts it back.

curl -s -H "Origin: https://evil.com" -H "Cookie: session=..." \
  -I https://target.com/api/account | grep -i access-control

Custom Nuclei templates

Write templates specific to the target's own stack instead of relying only on the default community set. Higher signal, far fewer false positives.

nuclei -u https://target.com -t custom-templates/ -severity medium,high,critical

Cache deception probes

Append a static-file-like extension to a sensitive authenticated path and see if the response gets cached for anyone.

curl -s https://target.com/account/settings.css -I | grep -i cache

Cross-role IDOR mapping

Replay identical requests with admin, standard-user, and guest tokens, then diff the responses for broken object-level authorization.

diff <(curl -s -H "Authorization: Bearer $ADMIN" $URL) \
     <(curl -s -H "Authorization: Bearer $USER"  $URL)

Tool cheat-sheet

Every tool from this playbook, in one place.

Frequently asked questions

Do I need to run every stage on every program?

No. Stage 1 always. Stages 2 to 5 scale with how mature the program is, if a program has thousands of hunters on it already, skip straight to Stage 2, the obvious surface is already saturated.

What if introspection or the Swagger file isn't exposed?

That's the common case, not the exception. Move on. These are high-value when they hit, not guaranteed wins on every target.

Is this workflow allowed under every bug bounty program?

Always check the program's scope and rules of engagement first. ASN sweeps and port scans in particular can fall outside scope on some programs. Read the policy before running anything here.

Which stage should a beginner focus on first?

Stage 1 and Stage 3. Get comfortable mapping assets and content before moving into JS mining, GraphQL, and IDOR work, those require more context to interpret correctly.